- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()
by Yu Liao 03 Jun '24

03 Jun '24

From: Zou Wei <zou_wei(a)huawei.com> stable inclusion from stable-v4.19.198 commit 522e75ed63f67e815d4ec0deace67df22d9ce78e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S3H8 CVE: CVE-2021-47323 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 90b7c141132244e8e49a34a4c1e445cce33e07f4 ] This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zou Wei <zou_wei(a)huawei.com> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Link: https://lore.kernel.org/r/1620716691-108460-1-git-send-email-zou_wei@huawei… Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/watchdog/sc520_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c index 6aadb56e7faa..809ebcaef51d 100644 --- a/drivers/watchdog/sc520_wdt.c +++ b/drivers/watchdog/sc520_wdt.c @@ -190,7 +190,7 @@ static int wdt_startup(void) static int wdt_turnoff(void) { /* Stop the timer */ - del_timer(&timer); + del_timer_sync(&timer); /* Stop the watchdog */ wdt_config(0); -- 2.25.1

2 1

[PATCH OLK-5.10 v2 0/2] CVE-2024-35808
by Li Nan 03 Jun '24

03 Jun '24

Li Nan (2): md/dm-raid: don't call md_reap_sync_thread() directly md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen drivers/md/md.h | 2 ++ drivers/md/dm-raid.c | 11 ++++------- drivers/md/md.c | 6 ++++-- 3 files changed, 10 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] scsi: megaraid_sas: Fix resource leak in case of probe failure
by Luo Gengkun 03 Jun '24

03 Jun '24

From: Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> mainline inclusion from mainline-v5.14-rc1 commit b5438f48fdd8e1c3f130d32637511efd32038152 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RE1F CVE: CVE-2021-47329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe. Clean up all those resources. Link: https://lore.kernel.org/r/20210528131307.25683-3-chandrakanth.patil@broadco… Signed-off-by: Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> Signed-off-by: Sumit Saxena <sumit.saxena(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/megaraid/megaraid_sas_base.c Signed-off-by: l00855224 <l00855224(a)notesmail.huawei.com/> --- drivers/scsi/megaraid/megaraid_sas_base.c | 10 ++++++++++ drivers/scsi/megaraid/megaraid_sas_fusion.c | 1 + 2 files changed, 11 insertions(+) diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c index 3f0752dc8ab5..b993b79ed38f 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -6620,11 +6620,16 @@ static int megasas_probe_one(struct pci_dev *pdev, return 0; fail_start_aen: + instance->unload = 1; + scsi_remove_host(instance->host); fail_io_attach: megasas_mgmt_info.count--; megasas_mgmt_info.max_index--; megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL; + if (instance->requestorId && !instance->skip_heartbeat_timer_del) + del_timer_sync(&instance->sriov_heartbeat_timer); + instance->instancet->disable_intr(instance); megasas_destroy_irqs(instance); @@ -6632,8 +6637,13 @@ static int megasas_probe_one(struct pci_dev *pdev, megasas_release_fusion(instance); else megasas_release_mfi(instance); + if (instance->msix_vectors) pci_free_irq_vectors(instance->pdev); + instance->msix_vectors = 0; + + if (instance->fw_crash_state != UNAVAILABLE) + megasas_free_host_crash_buffer(instance); fail_init_mfi: scsi_host_put(host); fail_alloc_instance: diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c index f45c54f02bfa..9d4941cb961b 100644 --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c @@ -4857,6 +4857,7 @@ megasas_alloc_fusion_context(struct megasas_instance *instance) if (!fusion->log_to_span) { dev_err(&instance->pdev->dev, "Failed from %s %d\n", __func__, __LINE__); + kfree(instance->ctrl_context); return -ENOMEM; } } -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: Fixes len calculation in mpage_journal_page_buffers
by Yifan Qiao 03 Jun '24

03 Jun '24

From: "Ritesh Harjani (IBM)" <ritesh.list(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit c2a09f3d782de952f09a3962d03b939e7fa7ffa4 category: bugfix bugzilla: 190028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- Truncate operation can race with writeback, in which inode->i_size can get truncated and therefore size - folio_pos() can be negative. This fixes the len calculation. However this path doesn't get easily triggered even with data journaling. Cc: stable(a)kernel.org # v6.5 Fixes: 80be8c5cc925 ("Fixes: ext4: Make mpage_journal_page_buffers use folio") Signed-off-by: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/cff4953b5c9306aba71e944ab176a5d396b9a1b7.17091822… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ext4/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 2c0e61f531f1..642522ace038 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2410,7 +2410,7 @@ static int mpage_journal_page_buffers(handle_t *handle, if (folio_pos(folio) + len > size && !ext4_verity_in_progress(inode)) - len = size - folio_pos(folio); + len = size & (len - 1); return ext4_journal_folio_buffers(handle, folio, len); } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] drm/amd/display: Avoid NULL dereference of timing generator
by Wenyu Huang 03 Jun '24

03 Jun '24

From: Wayne Lin <wayne.lin(a)amd.com> stable inclusion from stable-v4.19.315 commit 09909f515032fa80b921fd3118efe66b185d10fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4M5 CVE: CVE-2023-52753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ] [Why & How] Check whether assigned timing generator is NULL or not before accessing its funcs to prevent NULL dereference. Reviewed-by: Jun Lei <jun.lei(a)amd.com> Acked-by: Hersen Wu <hersenxs.wu(a)amd.com> Signed-off-by: Wayne Lin <wayne.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c index fdcc8ab19bf3..25b8a8f93382 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c @@ -281,7 +281,7 @@ uint32_t dc_stream_get_vblank_counter(const struct dc_stream_state *stream) for (i = 0; i < MAX_PIPES; i++) { struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg; - if (res_ctx->pipe_ctx[i].stream != stream) + if (res_ctx->pipe_ctx[i].stream != stream || !tg) continue; return tg->funcs->get_frame_count(tg); @@ -305,7 +305,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state *stream, for (i = 0; i < MAX_PIPES; i++) { struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg; - if (res_ctx->pipe_ctx[i].stream != stream) + if (res_ctx->pipe_ctx[i].stream != stream || !tg) continue; tg->funcs->get_scanoutpos(tg, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] i2c: smbus: fix NULL function pointer dereference
by Jinjiang Tu 03 Jun '24

03 Jun '24

From: Wolfram Sang <wsa+renesas(a)sang-engineering.com> stable inclusion from stable-v4.19.313 commit 40f1d79f07b49c8a64a861706e5163f2db4bd95d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRJ CVE: CVE-2024-35984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. Reported-by: Baruch Siach <baruch(a)tkos.co.il> Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.17127619… Fixes: 4b1acc43331d ("i2c: core changes for slave support") [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Tested-by: Baruch Siach <baruch(a)tkos.co.il> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index fdf644b53972..366bd86285d6 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1911,13 +1911,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, * Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging - * takes place. adap->algo->master_xfer existence isn't checked. + * takes place. */ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { unsigned long orig_jiffies; int ret, try; + if (!adap->algo->master_xfer) { + dev_dbg(&adap->dev, "I2C level transfers not supported\n"); + return -EOPNOTSUPP; + } + if (WARN_ON(!msgs || num < 1)) return -EINVAL; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] i2c: smbus: fix NULL function pointer dereference
by Jinjiang Tu 03 Jun '24

03 Jun '24

From: Wolfram Sang <wsa+renesas(a)sang-engineering.com> stable inclusion from stable-v5.10.216 commit 5fd72404587d7db4acb2d241fd8c387afb0a7aec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRJ CVE: CVE-2024-35984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. Reported-by: Baruch Siach <baruch(a)tkos.co.il> Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.17127619… Fixes: 4b1acc43331d ("i2c: core changes for slave support") [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Tested-by: Baruch Siach <baruch(a)tkos.co.il> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 40e05f762a1b..f86741ba8a00 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2060,13 +2060,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, * Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging - * takes place. adap->algo->master_xfer existence isn't checked. + * takes place. */ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { unsigned long orig_jiffies; int ret, try; + if (!adap->algo->master_xfer) { + dev_dbg(&adap->dev, "I2C level transfers not supported\n"); + return -EOPNOTSUPP; + } + if (WARN_ON(!msgs || num < 1)) return -EINVAL; @@ -2133,11 +2138,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { int ret; - if (!adap->algo->master_xfer) { - dev_dbg(&adap->dev, "I2C level transfers not supported\n"); - return -EOPNOTSUPP; - } - /* REVISIT the fault reporting model here is weak: * * - When we get an error after receiving N bytes from a slave, -- 2.25.1

2 1

[PATCH OLK-5.10] i2c: smbus: fix NULL function pointer dereference
by Jinjiang Tu 03 Jun '24

03 Jun '24

From: Wolfram Sang <wsa+renesas(a)sang-engineering.com> stable inclusion from stable-v5.10.216 commit 5fd72404587d7db4acb2d241fd8c387afb0a7aec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRJ CVE: CVE-2024-35984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. Reported-by: Baruch Siach <baruch(a)tkos.co.il> Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.17127619… Fixes: 4b1acc43331d ("i2c: core changes for slave support") [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Tested-by: Baruch Siach <baruch(a)tkos.co.il> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 40e05f762a1b..f86741ba8a00 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2060,13 +2060,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, * Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging - * takes place. adap->algo->master_xfer existence isn't checked. + * takes place. */ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { unsigned long orig_jiffies; int ret, try; + if (!adap->algo->master_xfer) { + dev_dbg(&adap->dev, "I2C level transfers not supported\n"); + return -EOPNOTSUPP; + } + if (WARN_ON(!msgs || num < 1)) return -EINVAL; @@ -2133,11 +2138,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { int ret; - if (!adap->algo->master_xfer) { - dev_dbg(&adap->dev, "I2C level transfers not supported\n"); - return -EOPNOTSUPP; - } - /* REVISIT the fault reporting model here is weak: * * - When we get an error after receiving N bytes from a slave, -- 2.25.1

2 1

[PATCH OLK-5.10 0/6] Add support for l0
by Wupeng Ma 03 Jun '24

03 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add support for l3t & l0. Ma Wupeng (6): export symbol alloc_contig_pages arm64: export cpu_logical_map hisi: l3t: Add L3 cache driver for hisi mm/mempolicy: Add and export get_policy_node hisi: l0: Add support for l0 arm64: config: Enable hisi l3t & l0 by default arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/setup.c | 1 + drivers/soc/hisilicon/Kconfig | 18 ++ drivers/soc/hisilicon/Makefile | 3 + drivers/soc/hisilicon/hisi_l0.c | 182 +++++++++++++++ drivers/soc/hisilicon/hisi_l3t.h | 45 ++++ drivers/soc/hisilicon/hisi_lockdown.c | 138 +++++++++++ drivers/soc/hisilicon/l3t.c | 307 +++++++++++++++++++++++++ include/linux/mempolicy.h | 4 + mm/mempolicy.c | 23 ++ mm/page_alloc.c | 1 + 11 files changed, 724 insertions(+) create mode 100644 drivers/soc/hisilicon/hisi_l0.c create mode 100644 drivers/soc/hisilicon/hisi_l3t.h create mode 100644 drivers/soc/hisilicon/hisi_lockdown.c create mode 100644 drivers/soc/hisilicon/l3t.c -- 2.25.1

2 7

[PATCH openEuler-22.03-LTS-SP1] drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
by Liu Chuang 03 Jun '24

03 Jun '24

From: Ma Ke <make_ruc2021(a)163.com> stable inclusion from stable-v5.10.202 commit 9acc2bc00135e9ecd13a70ce1140e2673e504cdc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RE6Q CVE: CVE-2023-52826 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ] In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke <make_ruc2021(a)163.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20231009090446.4043798-1-make_ruc2021@163.com Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20231009090446.4043798-1-make… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/panel/panel-tpo-tpg110.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/panel/panel-tpo-tpg110.c b/drivers/gpu/drm/panel/panel-tpo-tpg110.c index d57ed75a977c..494cec50a682 100644 --- a/drivers/gpu/drm/panel/panel-tpo-tpg110.c +++ b/drivers/gpu/drm/panel/panel-tpo-tpg110.c @@ -378,6 +378,8 @@ static int tpg110_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = tpg->panel_mode->bus_flags; mode = drm_mode_duplicate(connector->dev, &tpg->panel_mode->mode); + if (!mode) + return -ENOMEM; drm_mode_set_name(mode); mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/7] net: Bacport hulk patches
by Dong Chenchen 03 Jun '24

03 Jun '24

Bacport hulk patches Dong Chenchen (1): net: xfrm: skip policies marked as dead while reinserting policies Lu Wei (4): netfilter: make return-type and function-name in the same line bpf: fix magic numbers in bpf_get_sockops_uid_gid() bpf: socketmap: add Kconfig for customized socketmap tcp_comp: modify default value of TCP_COMP to n Ziyang Xuan (2): bpf: fix format type mismatch warning bpf: fix type incompatible warning arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/net/netfilter/nf_conntrack.h | 2 ++ include/net/sock.h | 6 +++++- net/Kconfig | 10 ++++++++++ net/core/filter.c | 11 ++++++++++- net/core/sock.c | 4 ++++ net/ipv4/Kconfig | 1 + net/netfilter/nf_conntrack_proto.c | 16 +++++++++++----- net/socket.c | 2 ++ net/xfrm/xfrm_policy.c | 13 +++++++++---- 11 files changed, 56 insertions(+), 11 deletions(-) -- 2.25.1

2 8

[PATCH openEuler-1.0-LTS] net: fix uninit-value in caif_seqpkt_sendmsg
by Ziyang Xuan 03 Jun '24

03 Jun '24

stable inclusion from stable-v4.19.199 commit 452c3ed7bf63721b07bc2238ed1261bb26027e85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4I0 CVE: CVE-2021-47297 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 991e634360f2622a683b48dfe44fe6d9cb765a09 ] When nr_segs equal to zero in iovec_from_user, the object msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg which is defined in ___sys_sendmsg. So we cann't just judge msg->msg_iter.iov->base directlly. We can use nr_segs to judge msg in caif_seqpkt_sendmsg whether has data buffers. ===================================================== BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343 ___sys_sendmsg net/socket.c:2397 [inline] __sys_sendmmsg+0x808/0xc90 net/socket.c:2480 __compat_sys_sendmmsg net/compat.c:656 [inline] Reported-by: syzbot+09a5d591c1f98cf5efcb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=1ace85e8fc9b0d5a45c08c2656c3e91762daa9… Fixes: bece7b2398d0 ("caif: Rewritten socket implementation") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/caif/caif_socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c index 6f7ea46e421c..cab0b239f96a 100644 --- a/net/caif/caif_socket.c +++ b/net/caif/caif_socket.c @@ -539,7 +539,8 @@ static int caif_seqpkt_sendmsg(struct socket *sock, struct msghdr *msg, goto err; ret = -EINVAL; - if (unlikely(msg->msg_iter.iov->iov_base == NULL)) + if (unlikely(msg->msg_iter.nr_segs == 0) || + unlikely(msg->msg_iter.iov->iov_base == NULL)) goto err; noblock = msg->msg_flags & MSG_DONTWAIT; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 03 Jun '24

03 Jun '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 V1] sched/core: Fix incorrect initialization of the 'burst' parameter in cpu_max_write()
by Cheng Yu 03 Jun '24

03 Jun '24

mainline inclusion from mainline-v6.10-rc1 commit 49217ea147df7647cb89161b805c797487783fc0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9UCB4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the cgroup v2 CPU subsystem, assuming we have a cgroup named 'test', and we set cpu.max and cpu.max.burst: # echo 1000000 > /sys/fs/cgroup/test/cpu.max # echo 1000000 > /sys/fs/cgroup/test/cpu.max.burst then we check cpu.max and cpu.max.burst: # cat /sys/fs/cgroup/test/cpu.max 1000000 100000 # cat /sys/fs/cgroup/test/cpu.max.burst 1000000 Next we set cpu.max again and check cpu.max and cpu.max.burst: # echo 2000000 > /sys/fs/cgroup/test/cpu.max # cat /sys/fs/cgroup/test/cpu.max 2000000 100000 # cat /sys/fs/cgroup/test/cpu.max.burst 1000 ... we find that the cpu.max.burst value changed unexpectedly. In cpu_max_write(), the unit of the burst value returned by tg_get_cfs_burst() is microseconds, while in cpu_max_write(), the burst unit used for calculation should be nanoseconds, which leads to the bug. To fix it, get the burst value directly from tg->cfs_bandwidth.burst. Fixes: f4183717b370 ("sched/fair: Introduce the burstable CFS controller") Reported-by: Qixin Liao <liaoqixin(a)huawei.com> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Vincent Guittot <vincent.guittot(a)linaro.org> Tested-by: Vincent Guittot <vincent.guittot(a)linaro.org> Link: https://lore.kernel.org/r/20240424132438.514720-1-serein.chengyu@huawei.com Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index f5b929ef9652..700dbd19eb44 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -12055,7 +12055,7 @@ static ssize_t cpu_max_write(struct kernfs_open_file *of, { struct task_group *tg = css_tg(of_css(of)); u64 period = tg_get_cfs_period(tg); - u64 burst = tg_get_cfs_burst(tg); + u64 burst = tg->cfs_bandwidth.burst; u64 quota; int ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/amd/pm: Update intermediate power state for SI
by Liu Chuang 03 Jun '24

03 Jun '24

From: Lijo Lazar <lijo.lazar(a)amd.com> mainline inclusion from mainline-v5.15-rc3 commit ab39d3cef526ba09c4c6923b4cd7e6ec1c5d4faa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O8 CVE: CVE-2021-47362 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Update the current state as boot state during dpm initialization. During the subsequent initialization, set_power_state gets called to transition to the final power state. set_power_state refers to values from the current state and without current state populated, it could result in NULL pointer dereference. For ex: on platforms where PCI speed change is supported through ACPI ATCS method, the link speed of current state needs to be queried before deciding on changing to final power state's link speed. The logic to query ATCS-support was broken on certain platforms. The issue became visible when broken ATCS-support logic got fixed with commit f9b7f3703ff9 ("drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)"). Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698 Signed-off-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/powerplay/si_dpm.c drivers/gpu/drm/amd/amdgpu/si_dpm.c [The conflict occurs because commit e098bc9612c2("drm/amd/pm: optimize the power related source code layout") is not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/si_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c index 7c724d3de111..0b80cd38f968 100644 --- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c +++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c @@ -6888,6 +6888,8 @@ static int si_dpm_enable(struct amdgpu_device *adev) si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true); si_thermal_start_thermal_controller(adev); + ni_update_current_ps(adev, boot_ps); + return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10 v2 00/11] Memory access profiler(SPE) driven NUMA balancing
by Ze Zuo 02 Jun '24

02 Jun '24

Hi, In Arm processors, there is a hardware PMU (Performance Monitoring Unit) facility called Statistical Profiling Extension (SPE) that can gather memory access metrics. In this patchset, SPE is exploited as an access information sampling approach to drive NUMA balancing. This sampling approach is introducedto replace the method based on address space scanning and hint faults with the access information provided by the hardware. With this, it is no longer necessary for NUMA balancing to scan over the address space periodically and rely on task-to-page association built by NUMA hint faults. Instead, the access samples obtained from hardware PMU are fed to NUMA balancing as equivalents to page fault. Except for the replaced sampling approach, the rest of the NUMA balancing policy is retained to do pages and tasks migrations according to the samples. Profiling based on SPE is an valid alternative sampling approach in NUMA balancing for the optimal page and task placement. This can be also extended to other architectures as long as there is a hardware PMU that supports memory access profiling. An abstract layer mem_sampling is introduced to reserve support for other kernel features and different types of hardware PMU. To help evaluate performance of this approach in system, syctl interfaces are added to enable/disable hardware mem sampling. NUMA balancing sampling approach can be also switched back to hint-faults- based approach dynamically. TODOs Currently, SPE for NUMA balance does not support PMD-level page migration, but it will be supported in later version. Changes since v1: -- clean code, no functional change. Ze Zuo (11): drivers/arm/spe: In-kernel SPE driver for page access profiling Add hardware PMU (mem_sampling) abstract layer mm/mem_sampling.c: Add controlling interface for mem_sampling Enable per-process mem_sampling from sched switch path Drive NUMA balancing via mem_sampling access data Add controlling interface for mem_sampling numa_balance tracing, numa balance: add trace events for numa data caused by mem_sampling driver/arm/spe: make mem_sampling and perf reuse arm spe driver tracing, mem-sampling-sample: add trace events for page access spe record ring buffer just for ctx origin flaw config: Enable MEM_SAMPLING for Numa balance by default arch/arm64/configs/openeuler_defconfig | 3 + arch/x86/configs/openeuler_defconfig | 1 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/arm/Kconfig | 2 + drivers/arm/spe/Kconfig | 11 + drivers/arm/spe/Makefile | 2 + drivers/arm/spe/spe-decoder/Makefile | 2 + drivers/arm/spe/spe-decoder/arm-spe-decoder.c | 213 +++++ drivers/arm/spe/spe-decoder/arm-spe-decoder.h | 74 ++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.c | 227 +++++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.h | 153 ++++ drivers/arm/spe/spe.c | 864 ++++++++++++++++++ drivers/arm/spe/spe.h | 130 +++ drivers/perf/Kconfig | 2 +- drivers/perf/arm_pmu_acpi.c | 30 +- drivers/perf/arm_spe_pmu.c | 371 ++------ include/linux/mem_sampling.h | 121 +++ include/linux/perf/arm_pmu.h | 8 + include/trace/events/kmem.h | 80 ++ kernel/sched/core.c | 2 + kernel/sched/fair.c | 12 + kernel/sched/sched.h | 1 + mm/Kconfig | 23 + mm/Makefile | 1 + mm/mem_sampling.c | 534 +++++++++++ samples/bpf/spe/Makefile | 26 + samples/bpf/spe/Makefile.arch | 47 + samples/bpf/spe/README.md | 0 samples/bpf/spe/spe-record.bpf.c | 40 + samples/bpf/spe/spe-record.h | 47 + samples/bpf/spe/spe-record.user.c | 116 +++ 32 files changed, 2834 insertions(+), 312 deletions(-) create mode 100644 drivers/arm/Kconfig create mode 100644 drivers/arm/spe/Kconfig create mode 100644 drivers/arm/spe/Makefile create mode 100644 drivers/arm/spe/spe-decoder/Makefile create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.h create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.h create mode 100644 drivers/arm/spe/spe.c create mode 100644 drivers/arm/spe/spe.h create mode 100644 include/linux/mem_sampling.h create mode 100644 mm/mem_sampling.c create mode 100644 samples/bpf/spe/Makefile create mode 100644 samples/bpf/spe/Makefile.arch create mode 100644 samples/bpf/spe/README.md create mode 100644 samples/bpf/spe/spe-record.bpf.c create mode 100644 samples/bpf/spe/spe-record.h create mode 100644 samples/bpf/spe/spe-record.user.c -- 2.33.0

2 12

[PATCH openEuler-1.0-LTS 0/8] Fix hugetlb deadlock
by Jinjiang Tu 01 Jun '24

01 Jun '24

fix hugetlb deadlock Jinjiang Tu (2): Revert "hugetlbfs: fix hugetlbfs_statfs() locking" Revert "hugetlb: make free_huge_page irq safe" Mike Kravetz (4): hugetlb: create remove_hugetlb_page() to separate functionality hugetlb: call update_and_free_page without hugetlb_lock hugetlb: change free_pool_huge_page to remove_pool_huge_page hugetlb: make free_huge_page irq safe Mina Almasry (1): hugetlbfs: fix hugetlbfs_statfs() locking Naoya Horiguchi (1): hugetlb: pass head page to remove_hugetlb_page() mm/hugetlb.c | 185 ++++++++++++++++++++++++++++++++------------------- 1 file changed, 117 insertions(+), 68 deletions(-) -- 2.25.1

2 9

[PATCH openEuler-1.0-LTS 0/2] *** scsi: megaraid_sas: Fix resource leak in case of probe failure ***
by Luo Gengkun 01 Jun '24

01 Jun '24

*** BLURB HERE *** Chandrakanth Patil (1): scsi: megaraid_sas: Fix resource leak in case of probe failure Shivasharan S (1): scsi: megaraid_sas: Add watchdog thread to detect Firmware fault drivers/scsi/megaraid/megaraid_sas.h | 12 +- drivers/scsi/megaraid/megaraid_sas_base.c | 47 +++++- drivers/scsi/megaraid/megaraid_sas_fusion.c | 176 ++++++++++++++------ 3 files changed, 181 insertions(+), 54 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] *** scsi: megaraid_sas: Fix resource leak in case of probe failure ***
by Luo Gengkun 01 Jun '24

01 Jun '24

*** BLURB HERE *** Chandrakanth Patil (1): scsi: megaraid_sas: Fix resource leak in case of probe failure Shivasharan S (1): scsi: megaraid_sas: Add watchdog thread to detect Firmware fault drivers/scsi/megaraid/megaraid_sas.h | 12 +- drivers/scsi/megaraid/megaraid_sas_base.c | 47 +++++- drivers/scsi/megaraid/megaraid_sas_fusion.c | 176 ++++++++++++++------ 3 files changed, 181 insertions(+), 54 deletions(-) -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 0/2] *** scsi: megaraid_sas: Fix resource leak in case of probe failure ***
by Luo Gengkun 01 Jun '24

01 Jun '24

*** BLURB HERE *** Chandrakanth Patil (1): scsi: megaraid_sas: Fix resource leak in case of probe failure Shivasharan S (1): scsi: megaraid_sas: Add watchdog thread to detect Firmware fault drivers/scsi/megaraid/megaraid_sas.h | 12 +- drivers/scsi/megaraid/megaraid_sas_base.c | 47 +++++- drivers/scsi/megaraid/megaraid_sas_fusion.c | 176 ++++++++++++++------ 3 files changed, 181 insertions(+), 54 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47511
by Liu Shixin 01 Jun '24

01 Jun '24

Fix CVE-2021-47511. Takashi Iwai (2): ALSA: pcm: oss: Fix a few more UBSAN fixes ALSA: pcm: oss: Fix negative period/buffer sizes sound/core/oss/pcm_oss.c | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS v2] ipack: ipoctal: fix module reference leak
by Liu Shixin 01 Jun '24

01 Jun '24

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v4.19.209 commit 9c5b77a7ffc983b2429ce158b50497c5d3c86a69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NR CVE: CVE-2021-47403 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bb8a4fcb2136508224c596a7e665bdba1d7c3c27 upstream. A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped. Fix this by taking the module reference and initialising the tty driver data when installing the tty. Fixes: 82a82340bab6 ("ipoctal: get carrier driver to avoid rmmod") Cc: stable(a)vger.kernel.org # 3.18 Cc: Federico Vaga <federico.vaga(a)cern.ch> Acked-by: Samuel Iglesias Gonsalvez <siglesias(a)igalia.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://lore.kernel.org/r/20210917114622.5412-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/ipack/devices/ipoctal.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c index aeadeaafdb26..dc39a84086c7 100644 --- a/drivers/ipack/devices/ipoctal.c +++ b/drivers/ipack/devices/ipoctal.c @@ -86,22 +86,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty) return 0; } -static int ipoctal_open(struct tty_struct *tty, struct file *file) +static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty) { struct ipoctal_channel *channel = dev_get_drvdata(tty->dev); struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index); - int err; - - tty->driver_data = channel; + int res; if (!ipack_get_carrier(ipoctal->dev)) return -EBUSY; - err = tty_port_open(&channel->tty_port, tty, file); - if (err) - ipack_put_carrier(ipoctal->dev); + res = tty_standard_install(driver, tty); + if (res) + goto err_put_carrier; + + tty->driver_data = channel; + + return 0; + +err_put_carrier: + ipack_put_carrier(ipoctal->dev); + + return res; +} + +static int ipoctal_open(struct tty_struct *tty, struct file *file) +{ + struct ipoctal_channel *channel = tty->driver_data; - return err; + return tty_port_open(&channel->tty_port, tty, file); } static void ipoctal_reset_stats(struct ipoctal_stats *stats) @@ -663,6 +675,7 @@ static void ipoctal_cleanup(struct tty_struct *tty) static const struct tty_operations ipoctal_fops = { .ioctl = NULL, + .install = ipoctal_install, .open = ipoctal_open, .close = ipoctal_close, .write = ipoctal_write_tty, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ipack: ipoctal: fix module reference leak
by Liu Shixin 01 Jun '24

01 Jun '24

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v4.19.209 commit 9c5b77a7ffc983b2429ce158b50497c5d3c86a69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NR CVE: CVE-2021-47403 -------------------------------- commit bb8a4fcb2136508224c596a7e665bdba1d7c3c27 upstream. A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped. Fix this by taking the module reference and initialising the tty driver data when installing the tty. Fixes: 82a82340bab6 ("ipoctal: get carrier driver to avoid rmmod") Cc: stable(a)vger.kernel.org # 3.18 Cc: Federico Vaga <federico.vaga(a)cern.ch> Acked-by: Samuel Iglesias Gonsalvez <siglesias(a)igalia.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://lore.kernel.org/r/20210917114622.5412-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/ipack/devices/ipoctal.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c index aeadeaafdb26..dc39a84086c7 100644 --- a/drivers/ipack/devices/ipoctal.c +++ b/drivers/ipack/devices/ipoctal.c @@ -86,22 +86,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty) return 0; } -static int ipoctal_open(struct tty_struct *tty, struct file *file) +static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty) { struct ipoctal_channel *channel = dev_get_drvdata(tty->dev); struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index); - int err; - - tty->driver_data = channel; + int res; if (!ipack_get_carrier(ipoctal->dev)) return -EBUSY; - err = tty_port_open(&channel->tty_port, tty, file); - if (err) - ipack_put_carrier(ipoctal->dev); + res = tty_standard_install(driver, tty); + if (res) + goto err_put_carrier; + + tty->driver_data = channel; + + return 0; + +err_put_carrier: + ipack_put_carrier(ipoctal->dev); + + return res; +} + +static int ipoctal_open(struct tty_struct *tty, struct file *file) +{ + struct ipoctal_channel *channel = tty->driver_data; - return err; + return tty_port_open(&channel->tty_port, tty, file); } static void ipoctal_reset_stats(struct ipoctal_stats *stats) @@ -663,6 +675,7 @@ static void ipoctal_cleanup(struct tty_struct *tty) static const struct tty_operations ipoctal_fops = { .ioctl = NULL, + .install = ipoctal_install, .open = ipoctal_open, .close = ipoctal_close, .write = ipoctal_write_tty, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pinctrl: core: delete incorrect free in pinctrl_enable()
by Yang Yingliang 01 Jun '24

01 Jun '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.9-rc7 commit 5038a66dad0199de60e5671603ea6623eb9e5c79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8C CVE: CVE-2024-36940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c(a)moroto.mountain> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pinctrl/core.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index c6ff4d5fa482..b50968f0ce2e 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -2037,11 +2037,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error = pinctrl_claim_hogs(pctldev); if (error) { - dev_err(pctldev->dev, "could not claim hogs: %i\n", - error); - mutex_destroy(&pctldev->mutex); - kfree(pctldev); - + dev_err(pctldev->dev, "could not claim hogs: %i\n", error); return error; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] arm64: cpufeature: Both the major and the minor version numbers need to be checked
by Zeng Heng 01 Jun '24

01 Jun '24

Zeng Heng (2): arm64: cpufeature: Both the major and the minor version numbers need to be checked arm64/mpam: skip mpam initialize under kdump kernel arch/arm64/include/asm/cpufeature.h | 7 +++++++ arch/arm64/kernel/cpufeature.c | 13 +++++++++---- arch/arm64/kernel/cpuinfo.c | 3 ++- arch/arm64/kernel/mpam.c | 4 ++++ 4 files changed, 22 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] media: gspca: cpia1: shift-out-of-bounds in set_flicker
by felix 01 Jun '24

01 Jun '24

From: Rajeshwar R Shinde <coolrrsh(a)gmail.com> stable inclusion from stable-v4.19.300 commit 2eee8edfff90e22980a6b22079d238c3c9d323bb bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4M7 CVE: CVE-2023-52764 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ] Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the value of the variable "sd->params.exposure.gain" exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added. Reported-by: syzbot+e27f3dbdab04e43b9f73(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73 Signed-off-by: Rajeshwar R Shinde <coolrrsh(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/media/usb/gspca/cpia1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c index 2b09af8865f4..5e785343528c 100644 --- a/drivers/media/usb/gspca/cpia1.c +++ b/drivers/media/usb/gspca/cpia1.c @@ -28,6 +28,7 @@ #include <linux/input.h> #include <linux/sched/signal.h> +#include <linux/bitops.h> #include "gspca.h" @@ -1033,6 +1034,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply) sd->params.exposure.expMode = 2; sd->exposure_status = EXPOSURE_NORMAL; } + if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp)) + return -EINVAL; currentexp = currentexp << sd->params.exposure.gain; sd->params.exposure.gain = 0; /* round down current exposure to nearest value */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] smackfs: restrict bytes count in smk_set_cipso()
by felix 01 Jun '24

01 Jun '24

From: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> stable inclusion from stable-v4.19.198 commit cbd87ba6a13891acf6180783f8234a8b7a3e3d4d bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RUUX CVE: CVE-2021-47336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 49ec114a6e62d8d320037ce71c1aaf9650b3cafd upstream. Oops, I failed to update subject line. Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write functions") missed that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Reported-by: syzbot <syzbot+77c53db50c9fff774e8e(a)syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/smack/smackfs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 115f790c3b12..9a04eb987be4 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -884,6 +884,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, if (format == SMK_FIXED24_FMT && (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) return -EINVAL; + if (count > PAGE_SIZE) + return -EINVAL; data = memdup_user_nul(buf, count); if (IS_ERR(data)) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 21354/22626] drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:157:29: sparse: sparse: incompatible types for operation (<):
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d2901c3f0ff7d121adf97d64bd2cc3789821600d commit: af48889301db8235deab66a8822e3e00195ca14b [21354/22626] dwmac:add phytium dwmac driver config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240601/202406011246.c9Ab6NVD-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240601/202406011246.c9Ab6NVD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406011246.c9Ab6NVD-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:157:29: sparse: sparse: incompatible types for operation (<): drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:157:29: sparse: void [noderef] <asn:2> *[addressable] [assigned] addr drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:157:29: sparse: int >> drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:172:5: sparse: sparse: symbol 'phytium_dwmac_remove' was not declared. Should it be static? drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c: In function 'phytium_dwmac_probe': drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:157:29: warning: ordered comparison of pointer with integer zero [-Wextra] 157 | if (stmmac_res.addr < 0) { | ^ drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:159:34: warning: returning 'void *' from a function with return type 'int' makes integer from pointer without a cast [-Wint-conversion] 159 | return stmmac_res.addr; | ~~~~~~~~~~^~~~~ drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c: At top level: drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c:172:5: warning: no previous prototype for 'phytium_dwmac_remove' [-Wmissing-prototypes] 172 | int phytium_dwmac_remove(struct platform_device *pdev) | ^~~~~~~~~~~~~~~~~~~~ vim +157 drivers/net/ethernet/stmicro/stmmac/dwmac-phytium.c 32 33 static int phytium_dwmac_probe(struct platform_device *pdev) 34 { 35 struct fwnode_handle *fwnode = dev_fwnode(&pdev->dev); 36 struct plat_stmmacenet_data *plat; 37 struct stmmac_resources stmmac_res; 38 struct device_node *np = pdev->dev.of_node; 39 struct resource *res; 40 u64 clk_freq; 41 char clk_name[20]; 42 int ret; 43 44 plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); 45 if (!plat) 46 return -ENOMEM; 47 48 plat->dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*plat->dma_cfg), 49 GFP_KERNEL); 50 if (!plat->dma_cfg) 51 return -ENOMEM; 52 53 plat->axi = devm_kzalloc(&pdev->dev, sizeof(*plat->axi), GFP_KERNEL); 54 if (!plat->axi) 55 return -ENOMEM; 56 57 plat->interface = device_get_phy_mode(&pdev->dev); 58 if (plat->interface < 0) 59 return plat->interface; 60 61 /* Configure PHY if using device-tree */ 62 if (pdev->dev.of_node) 63 plat->phy_node = of_parse_phandle(np, "phy-handle", 0); 64 65 if (pdev->dev.of_node) { 66 plat->bus_id = of_alias_get_id(np, "ethernet"); 67 if (plat->bus_id < 0) 68 plat->bus_id = 0; 69 } else if (fwnode_property_read_u32(fwnode, "bus_id", &plat->bus_id)) { 70 plat->bus_id = 2; 71 } 72 73 plat->phy_addr = -1; 74 plat->clk_csr = -1; 75 plat->has_gmac = 1; 76 plat->enh_desc = 1; 77 plat->bugged_jumbo = 1; 78 plat->pmt = 1; 79 plat->force_sf_dma_mode = 1; 80 81 if (fwnode_property_read_u32(fwnode, "max-speed", &plat->max_speed)) 82 plat->max_speed = -1; 83 84 if (fwnode_property_read_u32(fwnode, "max-frame-size", &plat->maxmtu)) 85 plat->maxmtu = JUMBO_LEN; 86 87 if (fwnode_property_read_u32(fwnode, "snps,multicast-filter-bins", 88 &plat->multicast_filter_bins)) 89 plat->multicast_filter_bins = HASH_TABLE_SIZE; 90 91 if (fwnode_property_read_u32(fwnode, "snps,perfect-filter-entries", 92 &plat->unicast_filter_entries)) 93 plat->unicast_filter_entries = 1; 94 95 if (fwnode_property_read_u32(fwnode, "tx-fifo-depth", 96 &plat->tx_fifo_size)) 97 plat->tx_fifo_size = 0x1000; 98 99 if (fwnode_property_read_u32(fwnode, "rx-fifo-depth", 100 &plat->rx_fifo_size)) 101 plat->rx_fifo_size = 0x1000; 102 103 if (phytium_dwmac_acpi_phy(plat, fwnode, &pdev->dev)) 104 return -ENODEV; 105 106 plat->rx_queues_to_use = 1; 107 plat->tx_queues_to_use = 1; 108 plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB; 109 plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB; 110 111 if (fwnode_property_read_u64(fwnode, "clock-frequency", &clk_freq)) 112 clk_freq = 125000000; 113 114 /* Set system clock */ 115 snprintf(clk_name, sizeof(clk_name), "%s-%d", "stmmaceth", 116 plat->bus_id); 117 118 plat->stmmac_clk = clk_register_fixed_rate(&pdev->dev, clk_name, 119 NULL, 0, clk_freq); 120 if (IS_ERR(plat->stmmac_clk)) { 121 dev_warn(&pdev->dev, "Fail to register stmmac-clk\n"); 122 plat->stmmac_clk = NULL; 123 } 124 125 ret = clk_prepare_enable(plat->stmmac_clk); 126 if (ret) { 127 clk_unregister_fixed_rate(plat->stmmac_clk); 128 return ret; 129 } 130 131 plat->clk_ptp_rate = clk_get_rate(plat->stmmac_clk); 132 plat->clk_ptp_ref = NULL; 133 134 if (fwnode_property_read_u32(fwnode, "snps,pbl", &plat->dma_cfg->pbl)) 135 plat->dma_cfg->pbl = 16; 136 137 fwnode_property_read_u32(fwnode, "snps,txpbl", &plat->dma_cfg->txpbl); 138 fwnode_property_read_u32(fwnode, "snps,rxpbl", &plat->dma_cfg->rxpbl); 139 140 plat->dma_cfg->pblx8 = !fwnode_property_read_bool(fwnode, 141 "snps,no-pbl-x8"); 142 plat->dma_cfg->aal = fwnode_property_read_bool(fwnode, "snps,aal"); 143 plat->dma_cfg->fixed_burst = fwnode_property_read_bool(fwnode, 144 "snps,fixed-burst"); 145 plat->dma_cfg->mixed_burst = fwnode_property_read_bool(fwnode, 146 "snps,mixed-burst"); 147 148 plat->axi->axi_lpi_en = false; 149 plat->axi->axi_xit_frm = false; 150 plat->axi->axi_wr_osr_lmt = 7; 151 plat->axi->axi_rd_osr_lmt = 7; 152 plat->axi->axi_blen[0] = 16; 153 154 memset(&stmmac_res, 0, sizeof(stmmac_res)); 155 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 156 stmmac_res.addr = devm_ioremap_resource(&pdev->dev, res); > 157 if (stmmac_res.addr < 0) { 158 dev_err(&pdev->dev, "resource map failed.\n"); 159 return stmmac_res.addr; 160 } 161 stmmac_res.irq = platform_get_irq(pdev, 0); 162 if (stmmac_res.irq < 0) { 163 dev_err(&pdev->dev, "IRQ not found.\n"); 164 return -ENXIO; 165 } 166 stmmac_res.wol_irq = stmmac_res.irq; 167 stmmac_res.lpi_irq = -1; 168 169 return stmmac_dvr_probe(&pdev->dev, plat, &stmmac_res); 170 } 171 > 172 int phytium_dwmac_remove(struct platform_device *pdev) 173 { 174 int ret; 175 struct net_device *ndev = platform_get_drvdata(pdev); 176 struct stmmac_priv *priv = netdev_priv(ndev); 177 struct plat_stmmacenet_data *plat = priv->plat; 178 179 ret = stmmac_pltfr_remove(pdev); 180 clk_unregister_fixed_rate(plat->stmmac_clk); 181 return ret; 182 } 183 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] comedi: dt9812: fix DMA buffers on stack
by Wang Hai 01 Jun '24

01 Jun '24

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v4.19.217 commit 39ea61037ae78f14fa121228dd962ea3280eacf3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD6O CVE: CVE-2021-47477 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 536de747bc48262225889a533db6650731ab25d3 upstream. USB transfer buffers are typically mapped for DMA and must not be allocated on the stack or transfers will fail. Allocate proper transfer buffers in the various command helpers and return an error on short transfers instead of acting on random stack data. Note that this also fixes a stack info leak on systems where DMA is not used as 32 bytes are always sent to the device regardless of how short the command is. Fixes: 63274cd7d38a ("Staging: comedi: add usb dt9812 driver") Cc: stable(a)vger.kernel.org # 2.6.29 Reviewed-by: Ian Abbott <abbotti(a)mev.co.uk> Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://lore.kernel.org/r/20211027093529.30896-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/staging/comedi/drivers/dt9812.c | 115 ++++++++++++++++++------ 1 file changed, 86 insertions(+), 29 deletions(-) diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c index 75cc9e8e5b94..ee0402bf6e67 100644 --- a/drivers/staging/comedi/drivers/dt9812.c +++ b/drivers/staging/comedi/drivers/dt9812.c @@ -32,6 +32,7 @@ #include <linux/kernel.h> #include <linux/module.h> #include <linux/errno.h> +#include <linux/slab.h> #include <linux/uaccess.h> #include "../comedi_usb.h" @@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; + size_t tbuf_size; int count, ret; + void *tbuf; - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); - cmd.u.flash_data_info.address = + tbuf_size = max(sizeof(*cmd), buf_size); + + tbuf = kzalloc(tbuf_size, GFP_KERNEL); + if (!tbuf) + return -ENOMEM; + + cmd = tbuf; + + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA); + cmd->u.flash_data_info.address = cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size); /* DT9812 only responds to 32 byte writes!! */ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); if (ret) - return ret; + goto out; + + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), + tbuf, buf_size, &count, DT9812_USB_TIMEOUT); + if (!ret) { + if (count == buf_size) + memcpy(buf, tbuf, buf_size); + else + ret = -EREMOTEIO; + } +out: + kfree(tbuf); - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), - buf, buf_size, &count, DT9812_USB_TIMEOUT); + return ret; } static int dt9812_read_multiple_registers(struct comedi_device *dev, @@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int i, count, ret; + size_t buf_size; + void *buf; - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); - cmd.u.read_multi_info.count = reg_count; + buf_size = max_t(size_t, sizeof(*cmd), reg_count); + + buf = kzalloc(buf_size, GFP_KERNEL); + if (!buf) + return -ENOMEM; + + cmd = buf; + + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); + cmd->u.read_multi_info.count = reg_count; for (i = 0; i < reg_count; i++) - cmd.u.read_multi_info.address[i] = address[i]; + cmd->u.read_multi_info.address[i] = address[i]; /* DT9812 only responds to 32 byte writes!! */ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); if (ret) - return ret; + goto out; + + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), + buf, reg_count, &count, DT9812_USB_TIMEOUT); + if (!ret) { + if (count == reg_count) + memcpy(value, buf, reg_count); + else + ret = -EREMOTEIO; + } +out: + kfree(buf); - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), - value, reg_count, &count, DT9812_USB_TIMEOUT); + return ret; } static int dt9812_write_multiple_registers(struct comedi_device *dev, @@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int i, count; + int ret; + + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); - cmd.u.read_multi_info.count = reg_count; + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); + cmd->u.read_multi_info.count = reg_count; for (i = 0; i < reg_count; i++) { - cmd.u.write_multi_info.write[i].address = address[i]; - cmd.u.write_multi_info.write[i].value = value[i]; + cmd->u.write_multi_info.write[i].address = address[i]; + cmd->u.write_multi_info.write[i].value = value[i]; } /* DT9812 only responds to 32 byte writes!! */ - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + kfree(cmd); + + return ret; } static int dt9812_rmw_multiple_registers(struct comedi_device *dev, @@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int i, count; + int ret; + + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); - cmd.u.rmw_multi_info.count = reg_count; + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); + cmd->u.rmw_multi_info.count = reg_count; for (i = 0; i < reg_count; i++) - cmd.u.rmw_multi_info.rmw[i] = rmw[i]; + cmd->u.rmw_multi_info.rmw[i] = rmw[i]; /* DT9812 only responds to 32 byte writes!! */ - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + kfree(cmd); + + return ret; } static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] smackfs: restrict bytes count in smk_set_cipso()
by felix 01 Jun '24

01 Jun '24

From: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> stable inclusion from stable-4.19.198 commit cbd87ba6a13891acf6180783f8234a8b7a3e3d4d bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RUUX CVE: CVE-2021-47336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 49ec114a6e62d8d320037ce71c1aaf9650b3cafd upstream. Oops, I failed to update subject line. Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write functions") missed that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Reported-by: syzbot <syzbot+77c53db50c9fff774e8e(a)syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/smack/smackfs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 115f790c3b12..9a04eb987be4 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -884,6 +884,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, if (format == SMK_FIXED24_FMT && (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) return -EINVAL; + if (count > PAGE_SIZE) + return -EINVAL; data = memdup_user_nul(buf, count); if (IS_ERR(data)) -- 2.34.1

2 1

[PATCH OLK-6.6 00/15] LoongArch: add GMAC&GNET support
by Hongchen Zhang 01 Jun '24

01 Jun '24

Yanteng Si (15): net: stmmac: Move the atds flag to the stmmac_dma_cfg structure net: stmmac: Add multi-channel support net: stmmac: Export dwmac1000_dma_ops net: stmmac: dwmac-loongson: Drop useless platform data net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification net: stmmac: dwmac-loongson: Split up the platform data initialization net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC net: stmmac: dwmac-loongson: Add full PCI support net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000. net: stmmac: dwmac-loongson: Add Loongson GNET support net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date net: stmmac: dwmac-loongson: Add loongson module author drivers/net/ethernet/stmicro/stmmac/common.h | 1 + .../ethernet/stmicro/stmmac/dwmac-loongson.c | 518 ++++++++++++++++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 4 +- .../ethernet/stmicro/stmmac/dwmac1000_dma.c | 35 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac4_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac_dma.h | 20 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 30 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 5 +- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 6 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 +- include/linux/stmmac.h | 2 + 13 files changed, 535 insertions(+), 103 deletions(-) -- 2.33.0

2 16

[PATCH openEuler-1.0-LTS] iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
by Jinjiang Tu 01 Jun '24

01 Jun '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.221 commit a3730f74159ad00a28960c0efe2a931fe6fe6b45 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27Y CVE: CVE-2021-47499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 70c9774e180d151abaab358108e3510a8e615215 upstream. When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the memory allocated by iio_triggered_buffer_setup() will not be freed, and cause memory leak as follows: unreferenced object 0xffff888009551400 (size 512): comm "i2c-SMO8500-125", pid 911, jiffies 4294911787 (age 83.852s) hex dump (first 32 bytes): 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff ........ ....... backtrace: [<0000000041ce75ee>] kmem_cache_alloc_trace+0x16d/0x360 [<000000000aeb17b0>] iio_kfifo_allocate+0x41/0x130 [kfifo_buf] [<000000004b40c1f5>] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer] [<000000004375b15f>] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013] Fix it by remove data->dready_trig condition in probe and remove. Reported-by: Hulk Robot <hulkci(a)huawei.com> Fixes: a25691c1f967 ("iio: accel: kxcjk1013: allow using an external trigger") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Cc: <Stable(a)vger.kernel.org> Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20211025124159.2700301-1-yangyingliang@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/iio/accel/kxcjk-1013.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c index e5fdca74a630..249f39b91ec1 100644 --- a/drivers/iio/accel/kxcjk-1013.c +++ b/drivers/iio/accel/kxcjk-1013.c @@ -1378,8 +1378,7 @@ static int kxcjk1013_probe(struct i2c_client *client, return 0; err_buffer_cleanup: - if (data->dready_trig) - iio_triggered_buffer_cleanup(indio_dev); + iio_triggered_buffer_cleanup(indio_dev); err_trigger_unregister: if (data->dready_trig) iio_trigger_unregister(data->dready_trig); @@ -1402,8 +1401,8 @@ static int kxcjk1013_remove(struct i2c_client *client) pm_runtime_set_suspended(&client->dev); pm_runtime_put_noidle(&client->dev); + iio_triggered_buffer_cleanup(indio_dev); if (data->dready_trig) { - iio_triggered_buffer_cleanup(indio_dev); iio_trigger_unregister(data->dready_trig); iio_trigger_unregister(data->motion_trig); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] platform/x86: wmi: Fix opening of char device
by Jinjiang Tu 01 Jun '24

01 Jun '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v5.10.201 commit d426a2955e45a95b2282764105fcfb110a540453 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFHT CVE: CVE-2023-52864 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ] Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/platform/x86/wmi.c [Conflicts due to prior cleanup commit 43aacf838ef7 is not merged.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/platform/x86/wmi.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 1f80b2628162..f3f8cc827573 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -818,21 +818,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) } static int wmi_char_open(struct inode *inode, struct file *filp) { - const char *driver_name = filp->f_path.dentry->d_iname; - struct wmi_block *wblock = NULL; - struct wmi_block *next = NULL; - - list_for_each_entry_safe(wblock, next, &wmi_block_list, list) { - if (!wblock->dev.dev.driver) - continue; - if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) { - filp->private_data = wblock; - break; - } - } + /* + * The miscdevice already stores a pointer to itself + * inside filp->private_data + */ + struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev); - if (!filp->private_data) - return -ENODEV; + filp->private_data = wblock; return nonseekable_open(inode, filp); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] platform/x86: wmi: Fix opening of char device
by Jinjiang Tu 01 Jun '24

01 Jun '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v5.10.201 commit d426a2955e45a95b2282764105fcfb110a540453 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFHT CVE: CVE-2023-52864 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ] Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/platform/x86/wmi.c [Conflicts due to prior cleanup commit 43aacf838ef7 is not merged.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/platform/x86/wmi.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 1f80b2628162..f3f8cc827573 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -818,21 +818,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) } static int wmi_char_open(struct inode *inode, struct file *filp) { - const char *driver_name = filp->f_path.dentry->d_iname; - struct wmi_block *wblock = NULL; - struct wmi_block *next = NULL; - - list_for_each_entry_safe(wblock, next, &wmi_block_list, list) { - if (!wblock->dev.dev.driver) - continue; - if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) { - filp->private_data = wblock; - break; - } - } + /* + * The miscdevice already stores a pointer to itself + * inside filp->private_data + */ + struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev); - if (!filp->private_data) - return -ENODEV; + filp->private_data = wblock; return nonseekable_open(inode, filp); } -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS c96c2b4fc4f4d908362c207ef0d61eb5b3a23e3f
by kernel test robot 01 Jun '24

01 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c96c2b4fc4f4d908362c207ef0d61eb5b3a23e3f !8221 Backport 5.10.207- 5.10.208 LTS patches from upstream Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 770m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240601 gcc arm64 randconfig-002-20240601 clang arm64 randconfig-003-20240601 clang arm64 randconfig-004-20240601 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240601 clang x86_64 buildonly-randconfig-002-20240601 clang x86_64 buildonly-randconfig-003-20240601 gcc x86_64 buildonly-randconfig-004-20240601 gcc x86_64 buildonly-randconfig-005-20240601 clang x86_64 buildonly-randconfig-006-20240601 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240601 gcc x86_64 randconfig-002-20240601 clang x86_64 randconfig-003-20240601 clang x86_64 randconfig-004-20240601 clang x86_64 randconfig-005-20240601 gcc x86_64 randconfig-006-20240601 clang x86_64 randconfig-011-20240601 clang x86_64 randconfig-012-20240601 clang x86_64 randconfig-013-20240601 clang x86_64 randconfig-014-20240601 gcc x86_64 randconfig-015-20240601 gcc x86_64 randconfig-016-20240601 gcc x86_64 randconfig-071-20240601 clang x86_64 randconfig-072-20240601 gcc x86_64 randconfig-073-20240601 clang x86_64 randconfig-074-20240601 gcc x86_64 randconfig-075-20240601 clang x86_64 randconfig-076-20240601 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS] platform/x86: wmi: Fix opening of char device
by Jinjiang Tu 01 Jun '24

01 Jun '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v5.10.201 commit d426a2955e45a95b2282764105fcfb110a540453 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFHT CVE: CVE-2023-52864 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ] Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/platform/x86/wmi.c [Conflicts due to prior cleanup commit 43aacf838ef7 is not merged.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/platform/x86/wmi.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 1f80b2628162..f3f8cc827573 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -818,21 +818,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) } static int wmi_char_open(struct inode *inode, struct file *filp) { - const char *driver_name = filp->f_path.dentry->d_iname; - struct wmi_block *wblock = NULL; - struct wmi_block *next = NULL; - - list_for_each_entry_safe(wblock, next, &wmi_block_list, list) { - if (!wblock->dev.dev.driver) - continue; - if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) { - filp->private_data = wblock; - break; - } - } + /* + * The miscdevice already stores a pointer to itself + * inside filp->private_data + */ + struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev); - if (!filp->private_data) - return -ENODEV; + filp->private_data = wblock; return nonseekable_open(inode, filp); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/sched: Avoid data corruptions
by felix 01 Jun '24

01 Jun '24

From: Andrey Grodzovsky <andrey.grodzovsky(a)amd.com> stable inclusion from stable-v5.10.51 commit 0687411e2a8858262de2fc4a1d576016fd77292e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4AY CVE: CVE-2021-47354 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0b10ab80695d61422337ede6ff496552d8ace99d ] Wait for all dependencies of a job to complete before killing it to avoid data corruptions. Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210519141407.88444-1-andrey… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/scheduler/sched_entity.c [Because 620e762f9a98 not merged, So fix the context] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/gpu/drm/scheduler/gpu_scheduler.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/scheduler/gpu_scheduler.c b/drivers/gpu/drm/scheduler/gpu_scheduler.c index 4fc211e19d6e..e7485cb688df 100644 --- a/drivers/gpu/drm/scheduler/gpu_scheduler.c +++ b/drivers/gpu/drm/scheduler/gpu_scheduler.c @@ -309,6 +309,7 @@ void drm_sched_entity_fini(struct drm_sched_entity *entity) */ if (spsc_queue_peek(&entity->job_queue)) { struct drm_sched_job *job; + struct dma_fence *f; int r; /* Park the kernel for a moment to make sure it isn't processing @@ -325,6 +326,10 @@ void drm_sched_entity_fini(struct drm_sched_entity *entity) while ((job = to_drm_sched_job(spsc_queue_pop(&entity->job_queue)))) { struct drm_sched_fence *s_fence = job->s_fence; + /* Wait for all dependencies to avoid data corruptions */ + while ((f = job->sched->ops->dependency(job, entity))) + dma_fence_wait(f, false); + drm_sched_fence_scheduled(s_fence); dma_fence_set_error(&s_fence->finished, -ESRCH); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: Fix even more out of bound writes from debugfs
by Kaixiong Yu 01 Jun '24

01 Jun '24

From: Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com> stable inclusion from stable-v5.14.16 commit 9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RCVW CVE: CVE-2021-47489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream. CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <tdwilliamsiv(a)gmail.com> Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones. v2: * Add missing fix in dp_max_bpc_write (Harry Wentland) Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") Signed-off-by: Patrik Jakobsson <pjakobsson(a)suse.de> Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index 32dbd2a27088..6914738f0275 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(struct file *f, const char __user *buf, if (!wr_buf) return -ENOSPC; - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us if (!wr_buf) return -ENOSPC; - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_write(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct file *f, const char __user *bu return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amdgpu: Fix even more out of bound writes from debugfs
by Kaixiong Yu 01 Jun '24

01 Jun '24

From: Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com> stable inclusion from stable-v5.14.16 commit 9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RCVW CVE: CVE-2021-47489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream. CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <tdwilliamsiv(a)gmail.com> Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones. v2: * Add missing fix in dp_max_bpc_write (Harry Wentland) Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") Signed-off-by: Patrik Jakobsson <pjakobsson(a)suse.de> Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index 32dbd2a27088..6914738f0275 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(struct file *f, const char __user *buf, if (!wr_buf) return -ENOSPC; - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us if (!wr_buf) return -ENOSPC; - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_write(struct file *f, const char __user *buf, return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { @@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct file *f, const char __user *bu return -ENOSPC; } - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, &param_nums)) { -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 18743/22626] /tmp/ccJZCoWT.s:2346: Error: immediate out of range at operand 3 -- `bic w0,w20,5'
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d2901c3f0ff7d121adf97d64bd2cc3789821600d commit: bba3f529a3ac03f6c6b8cea750cd48b355548d27 [18743/22626] xen/netback: don't queue unlimited number of packages config: arm64-randconfig-002-20240531 (https://download.01.org/0day-ci/archive/20240601/202406010715.TcWqtXea-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240601/202406010715.TcWqtXea-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010715.TcWqtXea-lkp@intel.com/ All errors (new ones prefixed by >>): /tmp/ccJZCoWT.s: Assembler messages: >> /tmp/ccJZCoWT.s:2346: Error: immediate out of range at operand 3 -- `bic w0,w20,5' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HARDLOCKUP_DETECTOR Depends on [n]: DEBUG_KERNEL [=n] && !S390 && (HAVE_HARDLOCKUP_DETECTOR_PERF [=n] || HAVE_HARDLOCKUP_DETECTOR_ARCH [=y]) Selected by [y]: - SDEI_WATCHDOG [=y] && <choice> && ARM_SDE_INTERFACE [=y] && !HARDLOCKUP_CHECK_TIMESTAMP [=n] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 735f0ab7121a98dd501241bd147c5c95e6e0b38c
by kernel test robot 01 Jun '24

01 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 735f0ab7121a98dd501241bd147c5c95e6e0b38c !7482 v2 perf parse-events: Make legacy events lower priority than sysfs/JSON Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202406010127.vZOEmkxm-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406010224.zmFA3hCw-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406010233.N3paZ0zK-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406010419.AVhJIZza-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] arch/arm64/kernel/ipi_nmi.c:41:2: error: call to undeclared function '__printk_safe_exit'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] drivers/platform/mpam/mpam_devices.c:247:11: error: call to undeclared function '__acpi_get_mem_attribute'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] mm/mem_reliable.c:345:2: error: call to undeclared function 'mem_reliable_ctrl_bit_disable'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] mm/page_alloc.c:4110:16: error: implicit declaration of function 'dynamic_pool_should_alloc' [-Werror=implicit-function-declaration] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-001-20240601 | `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used |-- arm64-randconfig-004-20240601 | `-- mm-page_alloc.c:error:implicit-declaration-of-function-dynamic_pool_should_alloc |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) `-- loongarch-randconfig-002-20240601 `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) clang_recent_errors |-- arm64-allmodconfig | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-002-20240601 | |-- arch-arm64-kernel-ipi_nmi.c:error:call-to-undeclared-function-__printk_safe_enter-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- arch-arm64-kernel-ipi_nmi.c:error:call-to-undeclared-function-__printk_safe_exit-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- drivers-platform-mpam-mpam_devices.c:error:call-to-undeclared-function-__acpi_get_mem_attribute-ISO-C99-and-later-do-not-support-implicit-function-declarations `-- arm64-randconfig-003-20240601 |-- arch-arm64-kernel-cpufeature.c:warning:unused-variable-enable_pseudo_nmi |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- mm-mem_reliable.c:error:call-to-undeclared-function-mem_reliable_ctrl_bit_disable-ISO-C99-and-later-do-not-support-implicit-function-declarations elapsed time: 772m configs tested: 16 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240601 gcc arm64 randconfig-002-20240601 clang arm64 randconfig-003-20240601 clang arm64 randconfig-004-20240601 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240601 gcc loongarch randconfig-002-20240601 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION d2901c3f0ff7d121adf97d64bd2cc3789821600d
by kernel test robot 01 Jun '24

01 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: d2901c3f0ff7d121adf97d64bd2cc3789821600d !8292 netfilter: conntrack: serialize hash resizes and cleanups Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405312041.sZcRQuA3-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405312200.hITrtAoH-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406010039.Hfpe41SX-lkp@intel.com Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-r122-20240531 | |-- drivers-net-can-phytium-phytium_can.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-__be32-const-usertype-p-got-unsigned-int | |-- drivers-net-can-phytium-phytium_can.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-val-got-restricted-__be32-usertype | |-- drivers-net-can-phytium-phytium_can.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be32-usertype-got-unsigned-int | |-- drivers-net-can-phytium-phytium_can.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-got-restricted-__be32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-asn-from-got-void | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-asn-from-got-void | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-asn-from-got-void-in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-struct-sss_tool_ffm_record_info-ffm_rd | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-to-got-void-out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_api.c:sparse:sparse:cast-from-restricted-__be32 | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_api.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-val-got-restricted-__be32-usertype | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-asn-addr-got-unsigned-char-usertype | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-asn-db_base-got-void-noderef-asn | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_init.c:sparse:sparse:cast-removes-address-space-asn-of-expression | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-asn-addr-got-unsigned-char-usertype | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-val-got-restricted-__be32-usertype | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-usertype-data-got-unsigned-char-noderef-usertype-a | |-- drivers-net-ethernet-3snic-sssnic-nic-.-tool-sss_tool_nic_qp_info.c:sparse:sparse:cast-removes-address-space-asn-of-expression | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.c:sparse:sparse:cast-removes-address-space-asn-of-expression | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-asn-rq_db_addr-got-unsigned-char-userty | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-asn-sq_db_addr-got-unsigned-char-userty | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.h:sparse:sparse:cast-removes-address-space-asn-of-expression | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-asn-addr-got-unsigned-long-long-usertype | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:implicit-declaration-of-function-vlan_dev_priv | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:invalid-type-argument-of-(have-int-) | |-- include-linux-mem_reliable.h:sparse:sparse:restricted-gfp_t-degrades-to-integer | `-- mm-page_alloc.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-unsigned-int |-- x86_64-buildonly-randconfig-004-20240601 | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240601 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-005-20240601 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-072-20240601 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-randconfig-074-20240601 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20240601 | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240601 | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-002-20240601 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-011-20240601 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-012-20240601 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-randconfig-073-20240601 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension elapsed time: 743m configs tested: 35 configs skipped: 131 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240601 gcc arm64 randconfig-002-20240601 gcc arm64 randconfig-003-20240601 gcc arm64 randconfig-004-20240601 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240601 clang x86_64 buildonly-randconfig-002-20240601 clang x86_64 buildonly-randconfig-003-20240601 gcc x86_64 buildonly-randconfig-004-20240601 gcc x86_64 buildonly-randconfig-005-20240601 clang x86_64 buildonly-randconfig-006-20240601 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240601 gcc x86_64 randconfig-002-20240601 clang x86_64 randconfig-003-20240601 clang x86_64 randconfig-004-20240601 clang x86_64 randconfig-005-20240601 gcc x86_64 randconfig-006-20240601 clang x86_64 randconfig-011-20240601 clang x86_64 randconfig-012-20240601 clang x86_64 randconfig-013-20240601 clang x86_64 randconfig-014-20240601 gcc x86_64 randconfig-015-20240601 gcc x86_64 randconfig-016-20240601 gcc x86_64 randconfig-071-20240601 clang x86_64 randconfig-072-20240601 gcc x86_64 randconfig-073-20240601 clang x86_64 randconfig-074-20240601 gcc x86_64 randconfig-075-20240601 clang x86_64 randconfig-076-20240601 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2700/9806] drivers/platform/mpam/mpam_devices.c:247:11: error: call to undeclared function '__acpi_get_mem_attribute'; ISO C99 and later do not support implicit function declarations
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 735f0ab7121a98dd501241bd147c5c95e6e0b38c commit: 3e9e723f3bf92a19e5e15dda89bbb136ce463294 [2700/9806] arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate config: arm64-randconfig-002-20240601 (https://download.01.org/0day-ci/archive/20240601/202406010419.AVhJIZza-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project bafda89a0944d947fc4b3b5663185e07a397ac30) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240601/202406010419.AVhJIZza-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010419.AVhJIZza-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/platform/mpam/mpam_devices.c:212:24: error: no member named 'mon_sel_lock' in 'struct mpam_msc'; did you mean 'part_sel_lock'? 212 | spin_lock_init(&msc->mon_sel_lock); | ^~~~~~~~~~~~ | part_sel_lock include/linux/spinlock.h:335:38: note: expanded from macro 'spin_lock_init' 335 | __raw_spin_lock_init(spinlock_check(lock), \ | ^ drivers/platform/mpam/mpam_internal.h:43:14: note: 'part_sel_lock' declared here 43 | spinlock_t part_sel_lock; | ^ >> drivers/platform/mpam/mpam_devices.c:247:11: error: call to undeclared function '__acpi_get_mem_attribute'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 247 | prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); | ^ drivers/platform/mpam/mpam_devices.c:247:9: error: assigning to 'pgprot_t' from incompatible type 'int' 247 | prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3 errors generated. vim +/__acpi_get_mem_attribute +247 drivers/platform/mpam/mpam_devices.c 170 171 static int mpam_msc_drv_probe(struct platform_device *pdev) 172 { 173 int err; 174 pgprot_t prot; 175 void * __iomem io; 176 struct mpam_msc *msc; 177 struct resource *msc_res; 178 void *plat_data = pdev->dev.platform_data; 179 180 mutex_lock(&mpam_list_lock); 181 do { 182 msc = devm_kzalloc(&pdev->dev, sizeof(*msc), GFP_KERNEL); 183 if (!msc) { 184 err = -ENOMEM; 185 break; 186 } 187 188 INIT_LIST_HEAD_RCU(&msc->glbl_list); 189 msc->pdev = pdev; 190 191 err = device_property_read_u32(&pdev->dev, "arm,not-ready-us", 192 &msc->nrdy_usec); 193 if (err) { 194 /* This will prevent CSU monitors being usable */ 195 msc->nrdy_usec = 0; 196 } 197 198 err = get_msc_affinity(msc); 199 if (err) 200 break; 201 if (cpumask_empty(&msc->accessibility)) { 202 pr_err_once("msc:%u is not accessible from any CPU!", 203 msc->id); 204 err = -EINVAL; 205 break; 206 } 207 208 mutex_init(&msc->lock); 209 msc->id = mpam_num_msc++; 210 INIT_LIST_HEAD_RCU(&msc->ris); 211 spin_lock_init(&msc->part_sel_lock); 212 spin_lock_init(&msc->mon_sel_lock); 213 214 if (device_property_read_u32(&pdev->dev, "pcc-channel", 215 &msc->pcc_subspace_id)) 216 msc->iface = MPAM_IFACE_MMIO; 217 else 218 msc->iface = MPAM_IFACE_PCC; 219 220 if (msc->iface == MPAM_IFACE_MMIO) { 221 io = devm_platform_get_and_ioremap_resource(pdev, 0, 222 &msc_res); 223 if (IS_ERR(io)) { 224 pr_err("Failed to map MSC base address\n"); 225 devm_kfree(&pdev->dev, msc); 226 err = PTR_ERR(io); 227 break; 228 } 229 msc->mapped_hwpage_sz = msc_res->end - msc_res->start; 230 msc->mapped_hwpage = io; 231 } else if (msc->iface == MPAM_IFACE_PCC) { 232 msc->pcc_cl.dev = &pdev->dev; 233 msc->pcc_cl.rx_callback = mpam_pcc_rx_callback; 234 msc->pcc_cl.tx_block = false; 235 msc->pcc_cl.tx_tout = 1000; /* 1s */ 236 msc->pcc_cl.knows_txdone = false; 237 238 msc->pcc_chan = pcc_mbox_request_channel(&msc->pcc_cl, 239 msc->pcc_subspace_id); 240 if (IS_ERR(msc->pcc_chan)) { 241 pr_err("Failed to request MSC PCC channel\n"); 242 devm_kfree(&pdev->dev, msc); 243 err = PTR_ERR(msc->pcc_chan); 244 break; 245 } 246 > 247 prot = __acpi_get_mem_attribute(msc->pcc_chan->shmem_base_addr); 248 io = ioremap_prot(msc->pcc_chan->shmem_base_addr, 249 msc->pcc_chan->shmem_size, pgprot_val(prot)); 250 if (IS_ERR(io)) { 251 pr_err("Failed to map MSC base address\n"); 252 pcc_mbox_free_channel(msc->pcc_chan); 253 devm_kfree(&pdev->dev, msc); 254 err = PTR_ERR(io); 255 break; 256 } 257 258 /* TODO: issue a read to update the registers */ 259 260 msc->mapped_hwpage_sz = msc->pcc_chan->shmem_size; 261 msc->mapped_hwpage = io + sizeof(struct acpi_pcct_shared_memory); 262 } 263 264 list_add_rcu(&msc->glbl_list, &mpam_all_msc); 265 platform_set_drvdata(pdev, msc); 266 } while (0); 267 mutex_unlock(&mpam_list_lock); 268 269 if (!err) { 270 /* Create RIS entries described by firmware */ 271 if (!acpi_disabled) 272 err = acpi_mpam_parse_resources(msc, plat_data); 273 else 274 err = mpam_dt_parse_resources(msc, plat_data); 275 } 276 277 if (!err && fw_num_msc == mpam_num_msc) 278 mpam_discovery_complete(); 279 280 return err; 281 } 282 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21121/22626] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:9: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d2901c3f0ff7d121adf97d64bd2cc3789821600d commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [21121/22626] Net: ethernet: Support 3snic 3s9xx network card config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240601/202406010313.eTrfPuma-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240601/202406010313.eTrfPuma-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010313.eTrfPuma-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:65:5: sparse: sparse: symbol 'rx_buff_size' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:28: sparse: sparse: undefined identifier 'vlan_dev_priv' drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: sparse: sparse: symbol 'sss_nic_port_module_cable_plug' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: sparse: sparse: symbol 'sss_nic_port_module_cable_unplug' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: sparse: sparse: symbol 'sss_nic_port_module_link_err' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1020:21: sparse: sparse: symbol 'g_nic_uld_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:21: sparse: sparse: symbol 'get_nic_uld_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c: In function 'sss_nic_get_vlan_depth': >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:28: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] 165 | vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; | ^~~~~~~~~~~~~ | netdev_priv >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:51: error: invalid type argument of '->' (have 'int') 165 | vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; | ^~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c: At top level: drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: warning: no previous prototype for 'sss_nic_port_module_cable_plug' [-Wmissing-prototypes] 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: warning: no previous prototype for 'sss_nic_port_module_cable_unplug' [-Wmissing-prototypes] 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: warning: no previous prototype for 'sss_nic_port_module_link_err' [-Wmissing-prototypes] 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: warning: no previous prototype for 'get_nic_uld_info' [-Wmissing-prototypes] 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:311:54: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned char [usertype] *db_base @@ got unsigned char [noderef] [usertype] <asn:2> *db_base @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:311:54: sparse: expected unsigned char [usertype] *db_base drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:311:54: sparse: got unsigned char [noderef] [usertype] <asn:2> *db_base >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:9: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:9: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:533:12: sparse: sparse: context imbalance in 'sss_ctrlq_msg_lock' - different lock contexts for basic block drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:547:13: sparse: sparse: context imbalance in 'sss_ctrlq_msg_unlock' - unexpected unlock -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:327:41: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] <asn:2> **db_base @@ got void [noderef] <asn:2> * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:327:41: sparse: expected void [noderef] <asn:2> **db_base drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:327:41: sparse: got void [noderef] <asn:2> * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:277:5: warning: no previous prototype for 'sss_reinit_ctrlq_ctx' [-Wmissing-prototypes] 277 | int sss_reinit_ctrlq_ctx(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:367:6: warning: no previous prototype for 'sss_deinit_ctrlq' [-Wmissing-prototypes] 367 | void sss_deinit_ctrlq(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:501:5: warning: no previous prototype for 'sss_init_ctrlq_channel' [-Wmissing-prototypes] 501 | int sss_init_ctrlq_channel(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:538:6: warning: no previous prototype for 'sss_deinit_ctrlq_channel' [-Wmissing-prototypes] 538 | void sss_deinit_ctrlq_channel(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:547:6: warning: no previous prototype for 'sss_ctrlq_flush_sync_cmd' [-Wmissing-prototypes] 547 | void sss_ctrlq_flush_sync_cmd(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:573:5: warning: no previous prototype for 'sss_wait_ctrlq_stop' [-Wmissing-prototypes] 573 | int sss_wait_ctrlq_stop(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:30: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:30: sparse: expected unsigned int [usertype] val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:30: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:73: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:73: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:73: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:312:30: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:312:30: sparse: expected unsigned int [usertype] val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:312:30: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:313:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:313:67: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:313:67: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:364:19: sparse: sparse: cast to restricted __be64 -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:346:24: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [usertype] *data @@ got unsigned char [noderef] [usertype] <asn:2> * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:346:24: sparse: expected unsigned char [usertype] *data drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:346:24: sparse: got unsigned char [noderef] [usertype] <asn:2> * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:252:5: warning: no previous prototype for 'sss_init_func_mbx_msg' [-Wmissing-prototypes] 252 | int sss_init_func_mbx_msg(void *hwdev, u16 func_num) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:401:5: warning: no previous prototype for 'sss_hwif_init_mbx' [-Wmissing-prototypes] 401 | int sss_hwif_init_mbx(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:449:6: warning: no previous prototype for 'sss_hwif_deinit_mbx' [-Wmissing-prototypes] 449 | void sss_hwif_deinit_mbx(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:872:6: warning: no previous prototype for 'sss_recv_mbx_aeq_handler' [-Wmissing-prototypes] 872 | void sss_recv_mbx_aeq_handler(void *handle, u8 *header, u8 size) | ^~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:311:32: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:309:54: sparse: sparse: incompatible types in conditional expression (different address spaces): drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:309:54: sparse: void [noderef] <asn:2> * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:309:54: sparse: unsigned char [usertype] * -- drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:31:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:34:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: expected unsigned int [usertype] val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:17: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: expected unsigned int [usertype] val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:17: sparse: sparse: cast from restricted __be32 -- drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:6: sparse: sparse: symbol 'sss_tool_free_in_buf' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:6: sparse: sparse: symbol 'sss_tool_free_out_buf' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:5: sparse: sparse: symbol 'sss_tool_alloc_in_buf' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:5: sparse: sparse: symbol 'sss_tool_alloc_out_buf' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:189:42: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:189:42: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:189:42: sparse: got void *out_buf drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:194:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:194:34: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:194:34: sparse: got void *out_buf drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:5: sparse: sparse: symbol 'sss_tool_copy_to_user' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:211:45: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buf @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:211:45: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:211:45: sparse: got void *in_buf drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:238:36: sparse: sparse: symbol 'g_deal_msg_handle' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:318:40: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:318:40: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:318:40: sparse: got void * >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:380:42: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got struct sss_tool_ffm_record_info *ffm_rd @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:380:42: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:380:42: sparse: got struct sss_tool_ffm_record_info *ffm_rd drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:416:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:416:37: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:416:37: sparse: got void * drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:6: warning: no previous prototype for 'sss_tool_free_in_buf' [-Wmissing-prototypes] 80 | void sss_tool_free_in_buf(void *hwdev, const struct sss_tool_msg *tool_msg, void *in_buf) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:6: warning: no previous prototype for 'sss_tool_free_out_buf' [-Wmissing-prototypes] 91 | void sss_tool_free_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:5: warning: no previous prototype for 'sss_tool_alloc_in_buf' [-Wmissing-prototypes] 104 | int sss_tool_alloc_in_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:5: warning: no previous prototype for 'sss_tool_alloc_out_buf' [-Wmissing-prototypes] 146 | int sss_tool_alloc_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:5: warning: no previous prototype for 'sss_tool_copy_to_user' [-Wmissing-prototypes] 182 | int sss_tool_copy_to_user(struct sss_tool_msg *tool_msg, | ^~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:498:5: sparse: sparse: symbol 'sss_tool_send_clp_msg' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:604:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:604:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:604:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:606:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:606:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:606:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:588:5: sparse: sparse: symbol 'sss_tool_adm_csr_rd32' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:635:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:635:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:635:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:637:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:637:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:637:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:621:5: sparse: sparse: symbol 'sss_tool_adm_csr_wr32' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:704:35: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:704:35: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:704:35: sparse: got void * drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:498:5: warning: no previous prototype for 'sss_tool_send_clp_msg' [-Wmissing-prototypes] 498 | int sss_tool_send_clp_msg(struct sss_hwdev *hwdev, u8 mod, u16 cmd, const void *buf_in, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:588:5: warning: no previous prototype for 'sss_tool_adm_csr_rd32' [-Wmissing-prototypes] 588 | int sss_tool_adm_csr_rd32(struct sss_hwdev *hwdev, u8 dest, u32 addr, u32 *val) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:621:5: warning: no previous prototype for 'sss_tool_adm_csr_wr32' [-Wmissing-prototypes] 621 | int sss_tool_adm_csr_wr32(struct sss_hwdev *hwdev, u8 dest, u32 addr, u32 val) | ^~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:710:9: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c: note: in included file: >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: got unsigned long long [usertype] * In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:14: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx.c: note: in included file: >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: got unsigned long long [usertype] * >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: got unsigned long long [usertype] * In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx.c:18: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c: note: in included file: >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: expected void volatile [noderef] <asn:2> *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:9: sparse: got unsigned long long [usertype] * In file included from include/linux/sctp.h:57, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:18: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:6: warning: no previous prototype for 'sss_nic_rq_watchdog_handler' [-Wmissing-prototypes] 179 | void sss_nic_rq_watchdog_handler(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:31: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] <asn:2> *sq_db_addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:28: sparse: expected unsigned char [noderef] [usertype] <asn:2> *sq_db_addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:28: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:31: sparse: sparse: cast removes address space '<asn:2>' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] <asn:2> *rq_db_addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:28: sparse: expected unsigned char [noderef] [usertype] <asn:2> *rq_db_addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:28: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c: note: in included file (through drivers/net/ethernet/3snic/sssnic/include/sss_hw.h): drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] -- >> drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:71:39: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:88:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] hw_pi @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:88:24: sparse: expected unsigned short [usertype] hw_pi drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:88:24: sparse: got restricted __be16 [usertype] drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:137:5: sparse: sparse: symbol 'sss_tool_get_tx_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:163:5: sparse: sparse: symbol 'sss_tool_get_tx_wqe_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:182:5: sparse: sparse: symbol 'sss_tool_get_rx_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:223:5: sparse: sparse: symbol 'sss_tool_get_rx_wqe_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:242:5: sparse: sparse: symbol 'sss_tool_get_rx_cqe_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:280:5: sparse: sparse: symbol 'sss_tool_get_q_num' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:304:5: sparse: sparse: symbol 'sss_tool_get_inter_num' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:137:5: warning: no previous prototype for 'sss_tool_get_tx_info' [-Wmissing-prototypes] 137 | int sss_tool_get_tx_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:163:5: warning: no previous prototype for 'sss_tool_get_tx_wqe_info' [-Wmissing-prototypes] 163 | int sss_tool_get_tx_wqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:182:5: warning: no previous prototype for 'sss_tool_get_rx_info' [-Wmissing-prototypes] 182 | int sss_tool_get_rx_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:223:5: warning: no previous prototype for 'sss_tool_get_rx_wqe_info' [-Wmissing-prototypes] 223 | int sss_tool_get_rx_wqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:242:5: warning: no previous prototype for 'sss_tool_get_rx_cqe_info' [-Wmissing-prototypes] 242 | int sss_tool_get_rx_cqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:280:5: warning: no previous prototype for 'sss_tool_get_q_num' [-Wmissing-prototypes] 280 | int sss_tool_get_q_num(struct sss_nic_dev *nic_dev, const void *in_buf, u32 in_len, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:304:5: warning: no previous prototype for 'sss_tool_get_inter_num' [-Wmissing-prototypes] 304 | int sss_tool_get_inter_num(struct sss_nic_dev *nic_dev, const void *in_buf, | ^~~~~~~~~~~~~~~~~~~~~~ vim +320 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c 306 307 static void sss_ctrlq_set_db(struct sss_ctrlq *ctrlq, 308 enum sss_ctrlq_type ctrlq_type, u16 pi) 309 { 310 struct sss_ctrlq_db db = {0}; 311 u8 *db_base = SSS_TO_HWDEV(ctrlq)->ctrlq_info->db_base; 312 313 sss_ctrlq_fill_db(&db, ctrlq_type, pi); 314 315 /* The data that is written to HW should be in Big Endian Format */ 316 db.info = sss_hw_be32(db.info); 317 db.head = sss_hw_be32(db.head); 318 319 wmb(); /* make sure write db info to reg */ > 320 writeq(*((u64 *)&db), SSS_CTRLQ_DB_ADDR(db_base, pi)); 321 } 322 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2392/9806] arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 735f0ab7121a98dd501241bd147c5c95e6e0b38c commit: 5e3e94b1477ca3f6cb47ae8137a4a99fe0ef6147 [2392/9806] arm64: Add non nmi ipi backtrace support config: arm64-randconfig-002-20240601 (https://download.01.org/0day-ci/archive/20240601/202406010224.zmFA3hCw-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project bafda89a0944d947fc4b3b5663185e07a397ac30) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240601/202406010224.zmFA3hCw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010224.zmFA3hCw-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/kernel/ipi_nmi.c:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 39 | __printk_safe_enter(); | ^ >> arch/arm64/kernel/ipi_nmi.c:41:2: error: call to undeclared function '__printk_safe_exit'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 41 | __printk_safe_exit(); | ^ 1 warning and 2 errors generated. vim +/__printk_safe_enter +39 arch/arm64/kernel/ipi_nmi.c 35 36 #ifdef CONFIG_NON_NMI_IPI_BACKTRACE 37 static void ipi_cpu_backtrace(void *info) 38 { > 39 __printk_safe_enter(); 40 nmi_cpu_backtrace(get_irq_regs()); > 41 __printk_safe_exit(); 42 } 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7193/9806] mm/page_alloc.c:4110:16: error: implicit declaration of function 'dynamic_pool_should_alloc'
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 735f0ab7121a98dd501241bd147c5c95e6e0b38c commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [7193/9806] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-004-20240601 (https://download.01.org/0day-ci/archive/20240601/202406010233.N3paZ0zK-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240601/202406010233.N3paZ0zK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010233.N3paZ0zK-lkp@intel.com/ All errors (new ones prefixed by >>): mm/page_alloc.c: In function 'mem_reliable_fallback_dpool': >> mm/page_alloc.c:4110:16: error: implicit declaration of function 'dynamic_pool_should_alloc' [-Werror=implicit-function-declaration] 4110 | return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); | ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2413/9806] mm/mem_reliable.c:345:2: error: call to undeclared function 'mem_reliable_ctrl_bit_disable'; ISO C99 and later do not support implicit function declarations
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 735f0ab7121a98dd501241bd147c5c95e6e0b38c commit: 425771499c0742a996ab28df143d7a5123102686 [2413/9806] mm: mem_reliable: Introduce proc interface to disable memory reliable features config: arm64-randconfig-003-20240601 (https://download.01.org/0day-ci/archive/20240601/202406010127.vZOEmkxm-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project bafda89a0944d947fc4b3b5663185e07a397ac30) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240601/202406010127.vZOEmkxm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010127.vZOEmkxm-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/mem_reliable.c:5: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> mm/mem_reliable.c:345:2: error: call to undeclared function 'mem_reliable_ctrl_bit_disable'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 345 | mem_reliable_ctrl_bit_disable(idx); | ^ mm/mem_reliable.c:345:2: note: did you mean 'mem_reliable_ctrl_bit_disabled'? mm/mem_reliable.c:320:13: note: 'mem_reliable_ctrl_bit_disabled' declared here 320 | static void mem_reliable_ctrl_bit_disabled(int idx) {} | ^ mm/mem_reliable.c:376:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 376 | num += global_node_page_state(NR_LRU_BASE + LRU_ACTIVE_FILE); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~ mm/mem_reliable.c:377:45: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 377 | num += global_node_page_state(NR_LRU_BASE + LRU_INACTIVE_FILE); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~ 6 warnings and 1 error generated. vim +/mem_reliable_ctrl_bit_disable +345 mm/mem_reliable.c 322 323 static void mem_reliable_feature_disable(int idx) 324 { 325 char *str = NULL; 326 327 switch (idx) { 328 case MEM_RELIABLE_FALLBACK: 329 reliable_allow_fallback = false; 330 str = "fallback"; 331 break; 332 case MEM_RELIABLE_SHMEM: 333 shmem_reliable = false; 334 str = "shmem"; 335 break; 336 case MEM_RELIABLE_PAGECACHE: 337 pagecache_reliable = false; 338 str = "pagecache"; 339 break; 340 default: 341 pr_err("unknown index: %d", idx); 342 return; 343 } 344 > 345 mem_reliable_ctrl_bit_disable(idx); 346 pr_info("%s is disabled\n", str); 347 } 348 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21243/22626] drivers/net/can/phytium/phytium_can.c:366:28: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 01 Jun '24

01 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d2901c3f0ff7d121adf97d64bd2cc3789821600d commit: db0908f0353219c48495233e71e676da2cefee44 [21243/22626] can: can controller driver for phytium CPUs config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240601/202406010039.Hfpe41SX-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240601/202406010039.Hfpe41SX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406010039.Hfpe41SX-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/can/phytium/phytium_can.c:366:28: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int * @@ drivers/net/can/phytium/phytium_can.c:366:28: sparse: expected restricted __be32 const [usertype] *p drivers/net/can/phytium/phytium_can.c:366:28: sparse: got unsigned int * drivers/net/can/phytium/phytium_can.c:370:37: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int * @@ drivers/net/can/phytium/phytium_can.c:370:37: sparse: expected restricted __be32 const [usertype] *p drivers/net/can/phytium/phytium_can.c:370:37: sparse: got unsigned int * >> drivers/net/can/phytium/phytium_can.c:436:51: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] @@ got unsigned int @@ drivers/net/can/phytium/phytium_can.c:436:51: sparse: expected restricted __be32 [usertype] drivers/net/can/phytium/phytium_can.c:436:51: sparse: got unsigned int >> drivers/net/can/phytium/phytium_can.c:568:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 @@ drivers/net/can/phytium/phytium_can.c:568:31: sparse: expected unsigned int drivers/net/can/phytium/phytium_can.c:568:31: sparse: got restricted __be32 drivers/net/can/phytium/phytium_can.c:569:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 @@ drivers/net/can/phytium/phytium_can.c:569:31: sparse: expected unsigned int drivers/net/can/phytium/phytium_can.c:569:31: sparse: got restricted __be32 drivers/net/can/phytium/phytium_can.c:601:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __be32 @@ drivers/net/can/phytium/phytium_can.c:601:31: sparse: expected unsigned int drivers/net/can/phytium/phytium_can.c:601:31: sparse: got restricted __be32 >> drivers/net/can/phytium/phytium_can.c:612:43: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/can/phytium/phytium_can.c:612:43: sparse: expected unsigned int [usertype] val drivers/net/can/phytium/phytium_can.c:612:43: sparse: got restricted __be32 [usertype] drivers/net/can/phytium/phytium_can.c:1050: warning: Function parameter or member 'skb' not described in 'phytium_can_start_xmit' drivers/net/can/phytium/phytium_can.c:1050: warning: Function parameter or member 'dev' not described in 'phytium_can_start_xmit' vim +366 drivers/net/can/phytium/phytium_can.c 355 356 static int phytium_can_read_fifo(struct net_device *dev) 357 { 358 struct net_device_stats *stats = &dev->stats; 359 struct phytium_can_dev *cdev = netdev_priv(dev); 360 struct canfd_frame *cf; 361 struct sk_buff *skb; 362 u32 id, dlc, i; 363 364 /* Read the frame header from FIFO */ 365 id = phytium_can_read(cdev, CAN_RX_FIFO); > 366 id = be32_to_cpup(&id); 367 if (id & CAN_IDE_MASK) { 368 /* Received an extended frame */ 369 dlc = phytium_can_read(cdev, CAN_RX_FIFO); 370 dlc = be32_to_cpup(&dlc); 371 if (dlc & CAN_ID2_FDF_MASK) 372 skb = alloc_canfd_skb(dev, &cf); 373 else 374 skb = alloc_can_skb(dev, (struct can_frame **)&cf); 375 376 if (unlikely(!skb)) { 377 stats->rx_dropped++; 378 return 0; 379 } 380 381 if (dlc & CAN_ID2_FDF_MASK) { 382 /* CAN FD extended frame */ 383 if (dlc & CANFD_ID2_BRS_MASK) 384 cf->flags |= CANFD_BRS; 385 if (dlc & CANFD_ID2_ESI_MASK) 386 cf->flags |= CANFD_ESI; 387 cf->len = can_dlc2len((dlc & CANFD_ID2_DLC_MASK) >> 388 CANFD_ID2_DLC_OFF); 389 } else { 390 /* CAN extended frame */ 391 cf->len = get_can_dlc((dlc & CAN_ID2_DLC_MASK) >> 392 CAN_ID2_DLC_OFF); 393 } 394 395 cf->can_id = (id & CAN_ID1_MASK) >> 3; 396 cf->can_id |= (id & CAN_ID2_MASK) >> 1; 397 cf->can_id |= CAN_EFF_FLAG; 398 399 if (id & CAN_ID2_RTR_MASK) 400 cf->can_id |= CAN_RTR_FLAG; 401 } else { 402 /* Received a standard frame */ 403 if (id & CAN_ID1_FDF_MASK) 404 skb = alloc_canfd_skb(dev, &cf); 405 else 406 skb = alloc_can_skb(dev, (struct can_frame **)&cf); 407 408 if (unlikely(!skb)) { 409 stats->rx_dropped++; 410 return 0; 411 } 412 413 if (id & CAN_ID1_FDF_MASK) { 414 /* CAN FD extended frame */ 415 if (id & CANFD_ID1_BRS_MASK) 416 cf->flags |= CANFD_BRS; 417 if (id & CANFD_ID1_ESI_MASK) 418 cf->flags |= CANFD_ESI; 419 cf->len = can_dlc2len((id & CANFD_ID1_DLC_MASK) >> 420 CANFD_ID1_DLC_OFF); 421 } else { 422 /* CAN extended frame */ 423 cf->len = get_can_dlc((id & CAN_ID1_DLC_MASK) >> 424 CAN_ID1_DLC_OFF); 425 } 426 427 cf->can_id = (id & CAN_ID1_MASK) >> 21; 428 429 if (id & CAN_ID1_RTR_MASK) 430 cf->can_id |= CAN_RTR_FLAG; 431 } 432 433 if (!(cf->can_id & CAN_RTR_FLAG)) 434 /* Receive data frames */ 435 for (i = 0; i < cf->len; i += 4) > 436 *(__be32 *)(cf->data + i) = phytium_can_read(cdev, 437 CAN_RX_FIFO); 438 439 stats->rx_packets++; 440 stats->rx_bytes += cf->len; 441 netif_receive_skb(skb); 442 443 return 1; 444 } 445 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19126/22626] mm/page_alloc.c:3684:54: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d2901c3f0ff7d121adf97d64bd2cc3789821600d commit: 9b6c51cd780588813c5d327e2a6d677d010a2b6f [19126/22626] mm: fix zoneref mapping problem in memory reliable config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240531/202405312200.hITrtAoH-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240531/202405312200.hITrtAoH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405312200.hITrtAoH-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/mem_reliable.h:68:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4656:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4661:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4661:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4661:35: sparse: right side has type unsigned int mm/page_alloc.c:4677:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4677:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4677:35: sparse: right side has type unsigned int mm/page_alloc.c:4683:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4683:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4683:35: sparse: right side has type unsigned int mm/page_alloc.c:4698:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4698:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4698:35: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:3683:14: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:3684:45: sparse: sparse: restricted gfp_t degrades to integer >> mm/page_alloc.c:3684:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted gfp_t [usertype] flags @@ got unsigned int @@ mm/page_alloc.c:3684:54: sparse: expected restricted gfp_t [usertype] flags mm/page_alloc.c:3684:54: sparse: got unsigned int include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:3701:14: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:1489:6: warning: no previous prototype for 'set_zone_contiguous' [-Wmissing-prototypes] 1489 | void set_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1511:6: warning: no previous prototype for 'clear_zone_contiguous' [-Wmissing-prototypes] 1511 | void clear_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:70: mm/page_alloc.c: In function 'deferred_init_memmap': include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 44- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 47- | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1730:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1730 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~ include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 53- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 56- | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1746:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1746 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~ mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 63- | ^~ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 69- | ^~ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 75- | ^ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 81- | ^ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 87- | ^~ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 93- | ^~ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 99- | ^ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 105- | ^ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 111- | ^~ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 117- | ^~ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 123- | ^ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses vim +3684 mm/page_alloc.c 3673 3674 #ifdef CONFIG_MEMORY_RELIABLE 3675 static inline void reliable_fb_find_zone(gfp_t gfp_mask, 3676 struct alloc_context *ac) 3677 { 3678 if (!reliable_allow_fb_enabled()) 3679 return; 3680 3681 /* dst node don't have zone we want, fallback here */ 3682 if ((gfp_mask & __GFP_THISNODE) && (ac->high_zoneidx == ZONE_NORMAL) && 3683 (gfp_mask & ___GFP_RELIABILITY)) { > 3684 ac->high_zoneidx = gfp_zone(gfp_mask & ~___GFP_RELIABILITY); 3685 ac->preferred_zoneref = first_zones_zonelist( 3686 ac->zonelist, ac->high_zoneidx, ac->nodemask); 3687 } 3688 3689 return; 3690 } 3691 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] CVE-2023-52677
by Yuntao Liu 31 May '24

31 May '24

CVE-2023-52677 Alexandre Ghiti (1): riscv: Check if the code to patch lies in the exit section arch/riscv/include/asm/sections.h | 1 + arch/riscv/kernel/patch.c | 11 ++++++++++- arch/riscv/kernel/vmlinux.lds.S | 3 +++ 3 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix vf init and common user permissions issue
by Shuai Wu 31 May '24

31 May '24

Modify hrn3 dev file permissions to support common users use the RDMA API. Fixes: ae52f9c522dd ("infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver") Shuai Wu (1): net/ethernet/huawei/hiroce3: Fix vf init and common user permissions issue drivers/infiniband/hw/hiroce3/roce.h | 2 +- drivers/infiniband/hw/hiroce3/roce_main.c | 2 +- drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) -- 2.33.0

2 2

[openeuler:openEuler-1.0-LTS 18944/22626] include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d2901c3f0ff7d121adf97d64bd2cc3789821600d commit: 33d1f46ad98ea3a13752a6360d97732ab4e119b9 [18944/22626] mm: Introduce memory reliable config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240531/202405312041.sZcRQuA3-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240531/202405312041.sZcRQuA3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405312041.sZcRQuA3-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): >> include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4572:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4573:27: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4573:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4573:27: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:1477:6: warning: no previous prototype for 'set_zone_contiguous' [-Wmissing-prototypes] 1477 | void set_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1499:6: warning: no previous prototype for 'clear_zone_contiguous' [-Wmissing-prototypes] 1499 | void clear_zone_contiguous(struct zone *zone) | ^~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:70: mm/page_alloc.c: In function 'deferred_init_memmap': include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 28- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 31- | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1718:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1718 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~ include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 37- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 40- | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1734:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1734 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~ mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 47- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 53- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 59- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 65- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 71- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 77- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 83- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 89- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 95- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 101- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 107- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' vim +41 include/linux/mem_reliable.h 31 32 static inline bool skip_none_movable_zone(gfp_t gfp, struct zoneref *z) 33 { 34 if (!mem_reliable_is_enabled()) 35 return false; 36 37 if (!current->mm || (current->flags & PF_KTHREAD)) 38 return false; 39 40 /* user tasks can only alloc memory from non-mirrored region */ > 41 if (!(gfp & ___GFP_RELIABILITY) && (gfp & __GFP_HIGHMEM) && 42 (gfp & __GFP_MOVABLE)) { 43 if (zonelist_zone_idx(z) < ZONE_MOVABLE) 44 return true; 45 } 46 47 return false; 48 } 49 #else 50 #define reliable_enabled 0 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
by Yi Yang 31 May '24

31 May '24

From: Lorenzo Bianconi <lorenzo(a)kernel.org> stable inclusion from stable-v4.19.209 commit 76538c7b4df314bb937e44c5cb1782f37d47443c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4OD CVE: CVE-2021-47395 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 ] Limit max values for vht mcs and nss in ieee80211_parse_tx_radiotap routine in order to fix the following warning reported by syzbot: WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 Modules linked in: CPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] RIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 RSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216 RAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000 RDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100 R10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8 R13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004 FS: 00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740 netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089 __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165 __bpf_tx_skb net/core/filter.c:2114 [inline] __bpf_redirect_no_mac net/core/filter.c:2139 [inline] __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162 ____bpf_clone_redirect net/core/filter.c:2429 [inline] bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401 bpf_prog_eeb6f53a69e5c6a2+0x59/0x234 bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline] __bpf_prog_run include/linux/filter.h:624 [inline] bpf_prog_run include/linux/filter.h:631 [inline] bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119 bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline] __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline] __se_sys_bpf kernel/bpf/syscall.c:4689 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Reported-by: syzbot+0196ac871673f0c20f68(a)syzkaller.appspotmail.com Fixes: 646e76bb5daf4 ("mac80211: parse VHT info in injected frames") Signed-off-by: Lorenzo Bianconi <lorenzo(a)kernel.org> Link: https://lore.kernel.org/r/c26c3f02dcb38ab63b2f2534cb463d95ee81bb13.16321417… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/mac80211/tx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 4a63c4bdefeb..6b2e88a4e9fb 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2109,7 +2109,11 @@ static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local, } vht_mcs = iterator.this_arg[4] >> 4; + if (vht_mcs > 11) + vht_mcs = 0; vht_nss = iterator.this_arg[4] & 0xF; + if (!vht_nss || vht_nss > 8) + vht_nss = 1; break; /* -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] arm64: cpufeature: Both the major and the minor version numbers need to be checked
by Zeng Heng 31 May '24

31 May '24

Zeng Heng (2): arm64: cpufeature: Both the major and the minor version numbers need to be checked arm64/mpam: skip mpam initialize under kdump kernel arch/arm64/include/asm/cpufeature.h | 7 +++++++ arch/arm64/kernel/cpufeature.c | 13 +++++++++---- arch/arm64/kernel/cpuinfo.c | 3 ++- arch/arm64/kernel/mpam.c | 4 ++++ 4 files changed, 22 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] drm/amd/pm: Update intermediate power state for SI
by Liu Chuang 31 May '24

31 May '24

From: Lijo Lazar <lijo.lazar(a)amd.com> mainline inclusion from mainline-v5.15-rc3 commit ab39d3cef526ba09c4c6923b4cd7e6ec1c5d4faa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9TKIT CVE: CVE-2021-47362 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Update the current state as boot state during dpm initialization. During the subsequent initialization, set_power_state gets called to transition to the final power state. set_power_state refers to values from the current state and without current state populated, it could result in NULL pointer dereference. For ex: on platforms where PCI speed change is supported through ACPI ATCS method, the link speed of current state needs to be queried before deciding on changing to final power state's link speed. The logic to query ATCS-support was broken on certain platforms. The issue became visible when broken ATCS-support logic got fixed with commit f9b7f3703ff9 ("drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)"). Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698 Signed-off-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/powerplay/si_dpm.c drivers/gpu/drm/amd/amdgpu/si_dpm.c [The conflict occurs because commit e098bc9612c2("drm/amd/pm: optimize the power related source code layout") is not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/si_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c index 7c724d3de111..0b80cd38f968 100644 --- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c +++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c @@ -6888,6 +6888,8 @@ static int si_dpm_enable(struct amdgpu_device *adev) si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true); si_thermal_start_thermal_controller(adev); + ni_update_current_ps(adev, boot_ps); + return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] arm64: cpufeature: Both the major and the minor version numbers need to be checked
by Zeng Heng 31 May '24

31 May '24

Zeng Heng (2): arm64: cpufeature: Both the major and the minor version numbers need to be checked arm64/mpam: skip mpam initialize under kdump kernel arch/arm64/include/asm/cpufeature.h | 7 +++++++ arch/arm64/kernel/cpufeature.c | 13 +++++++++---- arch/arm64/kernel/cpuinfo.c | 3 ++- arch/arm64/kernel/mpam.c | 4 ++++ 4 files changed, 22 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] arm64/mpam: skip mpam initialize under kdump kernel
by Zeng Heng 31 May '24

31 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I92AK4 ----------------------------- Skip MPAM initialize when running under kdump kernel. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 02f43334f078..8fd9dbdc2b01 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -6,6 +6,7 @@ #include <linux/arm_mpam.h> #include <linux/jump_label.h> #include <linux/percpu.h> +#include <linux/crash_dump.h> DEFINE_STATIC_KEY_FALSE(arm64_mpam_has_hcr); DEFINE_STATIC_KEY_FALSE(mpam_enabled); @@ -14,6 +15,9 @@ DEFINE_PER_CPU(u64, arm64_mpam_current); static int __init arm64_mpam_register_cpus(void) { + if (is_kdump_kernel()) + return 0; + u64 mpamidr = read_sanitised_ftr_reg(SYS_MPAMIDR_EL1); u16 partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, mpamidr); u8 pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, mpamidr); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
by Ziyang Xuan 31 May '24

31 May '24

stable inclusion from stable-v4.19.213 commit 071bdef36391958c89af5fa2172f691b31baa212 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RBH0 CVE: CVE-2021-47442 -------------------------------- commit 291c932fc3692e4d211a445ba8aa35663831bac7 upstream. 'skb' is allocated in digital_in_send_sdd_req(), but not free when digital_in_send_cmd() failed, which will cause memory leak. Fix it by freeing 'skb' if digital_in_send_cmd() return failed. Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/digital_technology.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c index 2021d1d58a75..c092b02fde8a 100644 --- a/net/nfc/digital_technology.c +++ b/net/nfc/digital_technology.c @@ -474,8 +474,12 @@ static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev, skb_put_u8(skb, sel_cmd); skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR); - return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, - target); + rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, + target); + if (rc) + kfree_skb(skb); + + return rc; } static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg, -- 2.25.1

2 1

[PATCH OLK-5.10] iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
by Cai Xinchen 31 May '24

31 May '24

From: Zhang Shurong <zhang_shurong(a)foxmail.com> mainline inclusion from mainline-v6.7-rc1 commit 3a23b384e7e3d64d5587ad10729a34d4f761517e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REBR CVE: CVE-2023-52802 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- of_match_device() may fail and returns a NULL pointer. In practice there is no known reasonable way to trigger this, but in case one is added in future, harden the code by adding the check Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Link: https://lore.kernel.org/r/tencent_994DA85912C937E3B5405BA960B31ED90A08@qq.c… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/adc/stm32-adc-core.c [Only context conflicts] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/iio/adc/stm32-adc-core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c index 20fc867e3998..81724e0dec67 100644 --- a/drivers/iio/adc/stm32-adc-core.c +++ b/drivers/iio/adc/stm32-adc-core.c @@ -635,6 +635,8 @@ static int stm32_adc_probe(struct platform_device *pdev) struct stm32_adc_priv *priv; struct device *dev = &pdev->dev; struct device_node *np = pdev->dev.of_node; + const struct of_device_id *of_id; + struct resource *res; u32 max_rate; int ret; @@ -647,8 +649,11 @@ static int stm32_adc_probe(struct platform_device *pdev) return -ENOMEM; platform_set_drvdata(pdev, &priv->common); - priv->cfg = (const struct stm32_adc_priv_cfg *) - of_match_device(dev->driver->of_match_table, dev)->data; + of_id = of_match_device(dev->driver->of_match_table, dev); + if (!of_id) + return -ENODEV; + + priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); priv->common.base = devm_ioremap_resource(&pdev->dev, res); -- 2.34.1

2 1

[PATCH OLK-5.10] md: fix bi_status reporting in md_end_clone_io
by Li Nan 31 May '24

31 May '24

From: Song Liu <song(a)kernel.org> mainline inclusion from mainline-v6.7-rc3 commit 45b478951b2ba5aea70b2850c49c1aa83aedd0d2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9U1GO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- md_end_clone_io() may overwrite error status in orig_bio->bi_status with BLK_STS_OK. This could happen when orig_bio has BIO_CHAIN (split by md_submit_bio => bio_split_to_limits, for example). As a result, upper layer may miss error reported from md (or the device) and consider the failed IO was successful. Fix this by only update orig_bio->bi_status when current bio reports error and orig_bio is BLK_STS_OK. This is the same behavior as __bio_chain_endio(). Fixes: 10764815ff47 ("md: add io accounting for raid0 and raid5") Cc: stable(a)vger.kernel.org # v5.14+ Reported-by: Bhanu Victor DiCara <00bvd0+linux(a)gmail.com> Closes: https://lore.kernel.org/regressions/5727380.DvuYhMxLoT@bvd0/ Signed-off-by: Song Liu <song(a)kernel.org> Tested-by: Xiao Ni <xni(a)redhat.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Conflicts: drivers/md/md.c [ Context conflict ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 6df154ab9802..b6aeb0958ae2 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8723,7 +8723,8 @@ static void md_end_io_acct(struct bio *bio) struct md_io_acct *md_io_acct = bio->bi_private; struct bio *orig_bio = md_io_acct->orig_bio; - orig_bio->bi_status = bio->bi_status; + if (bio->bi_status && !orig_bio->bi_status) + orig_bio->bi_status = bio->bi_status; bio_end_io_acct(orig_bio, md_io_acct->start_time); bio_put(bio); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] backport for CVE-2023-52750
by Hongbo Li 31 May '24

31 May '24

Backport for CVE-2023-52750 Nathan Chancellor (2): arm64: Make CPU_BIG_ENDIAN depend on ld.bfd or ld.lld 13.0.0+ arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer arch/arm64/Kconfig | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
by Ziyang Xuan 31 May '24

31 May '24

stable inclusion from stable-v4.19.213 commit 9881b0c860649f27ef2565deef011e516390f416 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RBHJ CVE: CVE-2021-47443 -------------------------------- commit 58e7dcc9ca29c14e44267a4d0ea61e3229124907 upstream. 'params' is allocated in digital_tg_listen_mdaa(), but not free when digital_send_cmd() failed, which will cause memory leak. Fix it by freeing 'params' if digital_send_cmd() return failed. Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/digital_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c index ec0a8998e52d..d6258638a07a 100644 --- a/net/nfc/digital_core.c +++ b/net/nfc/digital_core.c @@ -286,6 +286,7 @@ int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param) static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) { struct digital_tg_mdaa_params *params; + int rc; params = kzalloc(sizeof(*params), GFP_KERNEL); if (!params) @@ -300,8 +301,12 @@ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2); params->sc = DIGITAL_SENSF_FELICA_SC; - return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, - 500, digital_tg_recv_atr_req, NULL); + rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, + 500, digital_tg_recv_atr_req, NULL); + if (rc) + kfree(params); + + return rc; } static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 31 May '24

31 May '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] platform/x86: wmi: Fix opening of char device
by Jinjiang Tu 31 May '24

31 May '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v4.19.299 commit cf098e937dd125c0317a0d6f261ac2a950a233d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFHT CVE: CVE-2023-52864 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ] Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/platform/x86/wmi.c [Conflicts due to prior cleanup commit 43aacf838ef7 is not merged.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/platform/x86/wmi.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 04791ea5d97b..eba605b967cb 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -783,21 +783,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) } static int wmi_char_open(struct inode *inode, struct file *filp) { - const char *driver_name = filp->f_path.dentry->d_iname; - struct wmi_block *wblock = NULL; - struct wmi_block *next = NULL; - - list_for_each_entry_safe(wblock, next, &wmi_block_list, list) { - if (!wblock->dev.dev.driver) - continue; - if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) { - filp->private_data = wblock; - break; - } - } + /* + * The miscdevice already stores a pointer to itself + * inside filp->private_data + */ + struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev); - if (!filp->private_data) - return -ENODEV; + filp->private_data = wblock; return nonseekable_open(inode, filp); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
by Cai Xinchen 31 May '24

31 May '24

From: Zhang Shurong <zhang_shurong(a)foxmail.com> mainline inclusion from mainline-v6.7-rc1 commit 3a23b384e7e3d64d5587ad10729a34d4f761517e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REBR CVE: CVE-2023-52802 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- of_match_device() may fail and returns a NULL pointer. In practice there is no known reasonable way to trigger this, but in case one is added in future, harden the code by adding the check Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Link: https://lore.kernel.org/r/tencent_994DA85912C937E3B5405BA960B31ED90A08@qq.c… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/adc/stm32-adc-core.c [Only context conflicts] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/iio/adc/stm32-adc-core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c index 38eb96693079..dc44d4de82cb 100644 --- a/drivers/iio/adc/stm32-adc-core.c +++ b/drivers/iio/adc/stm32-adc-core.c @@ -394,6 +394,8 @@ static int stm32_adc_probe(struct platform_device *pdev) struct stm32_adc_priv *priv; struct device *dev = &pdev->dev; struct device_node *np = pdev->dev.of_node; + const struct of_device_id *of_id; + struct resource *res; int ret; @@ -404,8 +406,11 @@ static int stm32_adc_probe(struct platform_device *pdev) if (!priv) return -ENOMEM; - priv->cfg = (const struct stm32_adc_priv_cfg *) - of_match_device(dev->driver->of_match_table, dev)->data; + of_id = of_match_device(dev->driver->of_match_table, dev); + if (!of_id) + return -ENODEV; + + priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); priv->common.base = devm_ioremap_resource(&pdev->dev, res); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] pinctrl: core: delete incorrect free in pinctrl_enable()
by Yang Yingliang 31 May '24

31 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.9-rc7 commit 5038a66dad0199de60e5671603ea6623eb9e5c79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8C CVE: CVE-2024-36940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c(a)moroto.mountain> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 1356d6a26d05..82b3cd6903c8 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -2098,13 +2098,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error = pinctrl_claim_hogs(pctldev); if (error) { - dev_err(pctldev->dev, "could not claim hogs: %i\n", - error); - pinctrl_free_pindescs(pctldev, pctldev->desc->pins, - pctldev->desc->npins); - mutex_destroy(&pctldev->mutex); - kfree(pctldev); - + dev_err(pctldev->dev, "could not claim hogs: %i\n", error); return error; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pinctrl: core: delete incorrect free in pinctrl_enable()
by Yang Yingliang 31 May '24

31 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.9-rc7 commit 5038a66dad0199de60e5671603ea6623eb9e5c79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8C CVE: CVE-2024-36940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c(a)moroto.mountain> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 1356d6a26d05..82b3cd6903c8 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -2098,13 +2098,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error = pinctrl_claim_hogs(pctldev); if (error) { - dev_err(pctldev->dev, "could not claim hogs: %i\n", - error); - pinctrl_free_pindescs(pctldev, pctldev->desc->pins, - pctldev->desc->npins); - mutex_destroy(&pctldev->mutex); - kfree(pctldev); - + dev_err(pctldev->dev, "could not claim hogs: %i\n", error); return error; } -- 2.25.1

2 1

[PATCH OLK-5.10] pinctrl: core: delete incorrect free in pinctrl_enable()
by Yang Yingliang 31 May '24

31 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.9-rc7 commit 5038a66dad0199de60e5671603ea6623eb9e5c79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8C CVE: CVE-2024-36940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c(a)moroto.mountain> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 1356d6a26d05..82b3cd6903c8 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -2098,13 +2098,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error = pinctrl_claim_hogs(pctldev); if (error) { - dev_err(pctldev->dev, "could not claim hogs: %i\n", - error); - pinctrl_free_pindescs(pctldev, pctldev->desc->pins, - pctldev->desc->npins); - mutex_destroy(&pctldev->mutex); - kfree(pctldev); - + dev_err(pctldev->dev, "could not claim hogs: %i\n", error); return error; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] pinctrl: core: delete incorrect free in pinctrl_enable()
by Yang Yingliang 31 May '24

31 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.9-rc7 commit 5038a66dad0199de60e5671603ea6623eb9e5c79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8C CVE: CVE-2024-36940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Fixes: 6118714275f0 ("pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <578fbe56-44e9-487c-ae95-29b695650f7c(a)moroto.mountain> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 1356d6a26d05..82b3cd6903c8 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -2098,13 +2098,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error = pinctrl_claim_hogs(pctldev); if (error) { - dev_err(pctldev->dev, "could not claim hogs: %i\n", - error); - pinctrl_free_pindescs(pctldev, pctldev->desc->pins, - pctldev->desc->npins); - mutex_destroy(&pctldev->mutex); - kfree(pctldev); - + dev_err(pctldev->dev, "could not claim hogs: %i\n", error); return error; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS 0/2] backport for CVE-2023-52750
by Hongbo Li 31 May '24

31 May '24

Backport for CVE-2023-52750 Nathan Chancellor (2): arm64: Make CPU_BIG_ENDIAN depend on ld.bfd or ld.lld 13.0.0+ arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer arch/arm64/Kconfig | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
by Cai Xinchen 31 May '24

31 May '24

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v4.19.198 commit cddee5c287e26f6b2ba5c0ffdfc3a846f2f10461 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S6TL CVE: CVE-2021-47330 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fad92b11047a748c996ebd6cfb164a63814eeb2e ] In the probe function, if the final 'serial_config()' fails, 'info' is leaking. Add a resource handling path to free this memory. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Link: https://lore.kernel.org/r/dc25f96b7faebf42e60fe8d02963c941cf4d8124.16219717… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/8250/serial_cs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c index c8186a05a453..271c0388e00d 100644 --- a/drivers/tty/serial/8250/serial_cs.c +++ b/drivers/tty/serial/8250/serial_cs.c @@ -306,6 +306,7 @@ static int serial_resume(struct pcmcia_device *link) static int serial_probe(struct pcmcia_device *link) { struct serial_info *info; + int ret; dev_dbg(&link->dev, "serial_attach()\n"); @@ -320,7 +321,15 @@ static int serial_probe(struct pcmcia_device *link) if (do_sound) link->config_flags |= CONF_ENABLE_SPKR; - return serial_config(link); + ret = serial_config(link); + if (ret) + goto free_info; + + return 0; + +free_info: + kfree(info); + return ret; } static void serial_detach(struct pcmcia_device *link) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
by Ziyang Xuan 31 May '24

31 May '24

mainline inclusion from mainline-v5.15-rc7 commit d9d52a3ebd284882f5562c88e55991add5d01586 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RB24 CVE: CVE-2021-47459 -------------------------------- It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... j1939_netdev_stop kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref, ...) REFCOUNT_WARN("addition on 0;...") ==================================================== refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0 The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to protect. Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@hua… Cc: stable(a)vger.kernel.org Reported-by: syzbot+85d9878b19c94f9019ad(a)syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/can/j1939/main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c index fed1de256827..ac5169891811 100644 --- a/net/can/j1939/main.c +++ b/net/can/j1939/main.c @@ -251,11 +251,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) struct j1939_priv *priv, *priv_new; int ret; - priv = j1939_priv_get_by_ndev(ndev); + spin_lock(&j1939_netdev_lock); + priv = j1939_priv_get_by_ndev_locked(ndev); if (priv) { kref_get(&priv->rx_kref); + spin_unlock(&j1939_netdev_lock); return priv; } + spin_unlock(&j1939_netdev_lock); priv = j1939_priv_create(ndev); if (!priv) @@ -271,10 +274,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) /* Someone was faster than us, use their priv and roll * back our's. */ + kref_get(&priv_new->rx_kref); spin_unlock(&j1939_netdev_lock); dev_put(ndev); kfree(priv); - kref_get(&priv_new->rx_kref); return priv_new; } j1939_priv_set(ndev, priv); -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] i40e: Fix freeing of uninitialized misc IRQ vector
by Cui GaoSheng 31 May '24

31 May '24

From: Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> stable inclusion from stable-v5.10.73 commit 97aeed72af4f83ae51534f0a2473ff52f8d66236 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ON CVE: CVE-2021-47424 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ] When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops: Trying to free already-free IRQ 266 WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 Workqueue: events work_for_cpu_fn RIP: 0010:__free_irq+0x9a/0x300 Call Trace: ? synchronize_irq+0x3a/0xa0 free_irq+0x2e/0x60 i40e_clear_interrupt_scheme+0x53/0x190 [i40e] i40e_probe.part.108+0x134b/0x1a40 [i40e] ? kmem_cache_alloc+0x158/0x1c0 ? acpi_ut_update_ref_count.part.1+0x8e/0x345 ? acpi_ut_update_object_reference+0x15e/0x1e2 ? strstr+0x21/0x70 ? irq_get_irq_data+0xa/0x20 ? mp_check_pin_attr+0x13/0xc0 ? irq_get_irq_data+0xa/0x20 ? mp_map_pin_to_irq+0xd3/0x2f0 ? acpi_register_gsi_ioapic+0x93/0x170 ? pci_conf1_read+0xa4/0x100 ? pci_bus_read_config_word+0x49/0x70 ? do_pci_enable_device+0xcc/0x100 local_pci_probe+0x41/0x90 work_for_cpu_fn+0x16/0x20 process_one_work+0x1a7/0x360 worker_thread+0x1cf/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x1f/0x40 The problem is that at that point misc IRQ vectors were not allocated yet and we get a call trace that driver is trying to free already free IRQ vectors. Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED PF state before calling i40e_free_misc_vector. This state is set only if misc IRQ vectors were properly initialized. Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup") Reported-by: PJ Waskiewicz <pwaskiewicz(a)jumptrading.com> Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> Signed-off-by: Mateusz Palczewski <mateusz.palczewski(a)intel.com> Tested-by: Dave Switzer <david.switzer(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index fc6550979118..84bb3ef9f638 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -4716,7 +4716,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf) { int i; - i40e_free_misc_vector(pf); + if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state)) + i40e_free_misc_vector(pf); i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector, I40E_IWARP_IRQ_PILE_ID); -- 2.34.1

2 1

[PATCH OLK-5.10] x86/sgx: Break up long non-preemptible delays in sgx_vepc_release()
by Xiang Yang 31 May '24

31 May '24

From: Jack Wang <jinpu.wang(a)ionos.com> mainline inclusion from mainline-v6.6-rc1 commit 3d7d72a34e05b23e21bafc8bfb861e73c86b31f3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9TZZB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On large enclaves we hit the softlockup warning with following call trace: xa_erase() sgx_vepc_release() __fput() task_work_run() do_exit() The latency issue is similar to the one fixed in: 8795359e35bc ("x86/sgx: Silence softlockup detection when releasing large enclaves") The test system has 64GB of enclave memory, and all is assigned to a single VM. Release of 'vepc' takes a longer time and causes long latencies, which triggers the softlockup warning. Add cond_resched() to give other tasks a chance to run and reduce latencies, which also avoids the softlockup detector. [ mingo: Rewrote the changelog. ] Fixes: 540745ddbc70 ("x86/sgx: Introduce virtual EPC for use by KVM guests") Reported-by: Yu Zhang <yu.zhang(a)ionos.com> Signed-off-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Tested-by: Yu Zhang <yu.zhang(a)ionos.com> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Reviewed-by: Kai Huang <kai.huang(a)intel.com> Acked-by: Haitao Huang <haitao.huang(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- arch/x86/kernel/cpu/sgx/virt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/cpu/sgx/virt.c b/arch/x86/kernel/cpu/sgx/virt.c index b4f9a50de776..6d0531f8b087 100644 --- a/arch/x86/kernel/cpu/sgx/virt.c +++ b/arch/x86/kernel/cpu/sgx/virt.c @@ -204,6 +204,7 @@ static int sgx_vepc_release(struct inode *inode, struct file *file) continue; xa_erase(&vepc->page_array, index); + cond_resched(); } /* @@ -222,6 +223,7 @@ static int sgx_vepc_release(struct inode *inode, struct file *file) list_add_tail(&epc_page->list, &secs_pages); xa_erase(&vepc->page_array, index); + cond_resched(); } /* @@ -243,6 +245,7 @@ static int sgx_vepc_release(struct inode *inode, struct file *file) if (sgx_vepc_free_page(epc_page)) list_add_tail(&epc_page->list, &secs_pages); + cond_resched(); } if (!list_empty(&secs_pages)) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] comedi: ni_usb6501: fix NULL-deref in command paths
by Cui GaoSheng 31 May '24

31 May '24

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v5.10.79 commit ef143dc0c3defe56730ecd3a9de7b3e1d7e557c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD2V CVE: CVE-2021-47476 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 907767da8f3a925b060c740e0b5c92ea7dbec440 upstream. The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing). Add the missing sanity checks to probe(). Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support") Cc: stable(a)vger.kernel.org # 3.18 Cc: Luca Ellero <luca.ellero(a)brickedbrain.com> Reviewed-by: Ian Abbott <abbotti(a)mev.co.uk> Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://lore.kernel.org/r/20211027093529.30896-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/staging/comedi/drivers/ni_usb6501.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c index 1bb1cb651349..75e5b57ae0d7 100644 --- a/drivers/staging/comedi/drivers/ni_usb6501.c +++ b/drivers/staging/comedi/drivers/ni_usb6501.c @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00}; +/* Largest supported packets */ +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); + enum commands { READ_PORT, WRITE_PORT, @@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) if (!devpriv->ep_rx || !devpriv->ep_tx) return -ENODEV; + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE) + return -ENODEV; + + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE) + return -ENODEV; + return 0; } -- 2.34.1

2 2

[PATCH OLK-5.10] mm/hugetlb: fix missing hugetlb_lock for resv uncharge
by Jinjiang Tu 31 May '24

31 May '24

From: Peter Xu <peterx(a)redhat.com> mainline inclusion from mainline-v6.9-rc6 commit b76b46902c2d0395488c8412e1116c2486cdfcb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QR5M CVE: CVE-2024-36000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held. Link: https://lkml.kernel.org/r/20240417211836.2742593-3-peterx@redhat.com Fixes: 79aa925bf239 ("hugetlb_cgroup: fix reservation accounting") Signed-off-by: Peter Xu <peterx(a)redhat.com> Reported-by: syzbot+4b8077a5fccc61c385a1(a)syzkaller.appspotmail.com Reviewed-by: Mina Almasry <almasrymina(a)google.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Conflicts due to page converts to folio.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index e04c21f735ad..e3746bcfc827 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2709,9 +2709,12 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, rsv_adjust = hugepage_subpool_put_pages(spool, 1, info); hugetlb_acct_memory(h, -rsv_adjust, info); - if (deferred_reserve) + if (deferred_reserve) { + spin_lock_irq(&hugetlb_lock); hugetlb_cgroup_uncharge_page_rsvd(hstate_index(h), pages_per_huge_page(h), page); + spin_unlock_irq(&hugetlb_lock); + } } return page; -- 2.25.1

2 1

[openeuler:OLK-6.6 9623/9796] arch/x86/kernel/zhaoxin_kh40000.c:322:26: sparse: sparse: symbol 'kh40000_dma_iommu_ops' was not declared. Should it be static?
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a4c1bb6d259c5f07d1cf526fcb8c10d67c43a825 commit: ef20808db09987137fba30519fb94a6b12b63ee7 [9623/9796] Add kh40000_iommu_dma_ops for KH-40000 platform config: x86_64-randconfig-123-20240531 (https://download.01.org/0day-ci/archive/20240531/202405311417.Uc6n3wMh-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240531/202405311417.Uc6n3wMh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405311417.Uc6n3wMh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static? >> arch/x86/kernel/zhaoxin_kh40000.c:322:26: sparse: sparse: symbol 'kh40000_dma_iommu_ops' was not declared. Should it be static? vim +/kh40000_dma_iommu_ops +322 arch/x86/kernel/zhaoxin_kh40000.c 321 > 322 const struct dma_map_ops kh40000_dma_iommu_ops = { 323 .flags = DMA_F_PCI_P2PDMA_SUPPORTED, 324 .alloc = kh40000_iommu_dma_alloc, 325 .free = kh40000_iommu_dma_free, 326 .unmap_page = kh40000_iommu_dma_unmap_page, 327 .alloc_pages = kh40000_dma_common_alloc_pages, 328 .free_pages = kh40000_dma_common_free_pages, 329 .alloc_noncontiguous = kh40000_iommu_dma_alloc_noncontiguous, 330 .free_noncontiguous = kh40000_iommu_dma_free_noncontiguous, 331 .mmap = kh40000_iommu_dma_mmap, 332 .get_sgtable = kh40000_iommu_dma_get_sgtable, 333 .map_page = kh40000_iommu_dma_map_page, 334 .map_sg = kh40000_iommu_dma_map_sg, 335 .unmap_sg = kh40000_iommu_dma_unmap_sg, 336 .sync_single_for_cpu = kh40000_iommu_dma_sync_single_for_cpu, 337 .sync_single_for_device = kh40000_iommu_dma_sync_single_for_device, 338 .sync_sg_for_cpu = kh40000_iommu_dma_sync_sg_for_cpu, 339 .sync_sg_for_device = kh40000_iommu_dma_sync_sg_for_device, 340 .map_resource = kh40000_iommu_dma_map_resource, 341 .unmap_resource = kh40000_iommu_dma_unmap_resource, 342 .get_merge_boundary = kh40000_iommu_dma_get_merge_boundary, 343 .opt_mapping_size = kh40000_iommu_dma_opt_mapping_size, 344 }; 345 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] 5.10: fix CVE-2024-35978
by Wupeng Ma 31 May '24

31 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-35978. Dmitry Antipov (1): Bluetooth: Fix memory leak in hci_req_sync_complete() net/bluetooth/hci_request.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] hugetlbfs: fix hugetlbfs_statfs() locking
by Jinjiang Tu 31 May '24

31 May '24

From: Mina Almasry <almasrymina(a)google.com> mainline inclusion from mainline-v5.19-rc1 commit 4b25f030ae69ba710eff587cabb4c57cb7e7a8a1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9SZXR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- After commit db71ef79b59b ("hugetlb: make free_huge_page irq safe"), the subpool lock should be locked with spin_lock_irq() and all call sites was modified as such, except for the ones in hugetlbfs_statfs(). Link: https://lkml.kernel.org/r/20220429202207.3045-1-almasrymina@google.com Fixes: db71ef79b59b ("hugetlb: make free_huge_page irq safe") Signed-off-by: Mina Almasry <almasrymina(a)google.com> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- fs/hugetlbfs/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 92077383f320..58e879f089c4 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1099,12 +1099,12 @@ static int hugetlbfs_statfs(struct dentry *dentry, struct kstatfs *buf) if (sbinfo->spool) { long free_pages; - spin_lock(&sbinfo->spool->lock); + spin_lock_irq(&sbinfo->spool->lock); buf->f_blocks = sbinfo->spool->max_hpages; free_pages = sbinfo->spool->max_hpages - sbinfo->spool->used_hpages; buf->f_bavail = buf->f_bfree = free_pages; - spin_unlock(&sbinfo->spool->lock); + spin_unlock_irq(&sbinfo->spool->lock); buf->f_files = sbinfo->max_inodes; buf->f_ffree = sbinfo->free_inodes; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] 4.19: fix CVE-2024-35978
by Wupeng Ma 31 May '24

31 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-35978. Dmitry Antipov (1): Bluetooth: Fix memory leak in hci_req_sync_complete() net/bluetooth/hci_request.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS 1606/22616] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:43:28: sparse: sparse: symbol 'hns3_pci_tbl' was not declared. Should it be static?
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e8bccb051f559b78517ce23633a3d983f48abb0b commit: 09262653590358d6bd64c121600490fcfa3312b3 [1606/22616] driver: hns3: update hns3 driver from drivers config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240531/202405311309.sjTeOAO2-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240531/202405311309.sjTeOAO2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405311309.sjTeOAO2-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:43:28: sparse: sparse: symbol 'hns3_pci_tbl' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1949:27: sparse: sparse: symbol 'hns3_err_handler' was not declared. Should it be static? In file included from include/linux/sctp.h:57, from drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:14: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_rx_checksum': drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:2414:33: warning: this statement may fall through [-Wimplicit-fallthrough=] 2414 | skb->csum_level = 1; | ~~~~~~~~~~~~~~~~^~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:2415:9: note: here 2415 | case HNS3_OL4_TYPE_NO_TUN: | ^~~~ vim +/hns3_pci_tbl +43 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 35 36 /* hns3_pci_tbl - PCI Device ID Table 37 * 38 * Last entry must be all 0s 39 * 40 * { Vendor ID, Device ID, SubVendor ID, SubDevice ID, 41 * Class, Class Mask, private data (not used) } 42 */ > 43 const struct pci_device_id hns3_pci_tbl[] = { 44 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_GE), 0}, 45 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE), 0}, 46 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA), 47 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 48 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC), 49 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 50 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 51 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 52 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 53 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 54 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 55 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 56 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_VF), 0}, 57 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_DCB_PFC_VF), 58 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 59 /* required last entry */ 60 {0, } 61 }; 62 MODULE_DEVICE_TABLE(pci, hns3_pci_tbl); 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9622/9794] arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static?
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a4c1bb6d259c5f07d1cf526fcb8c10d67c43a825 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9622/9794] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-randconfig-123-20240531 (https://download.01.org/0day-ci/archive/20240531/202405311319.BzJDMWBG-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240531/202405311319.BzJDMWBG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405311319.BzJDMWBG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static? vim +/zhaoxin_patch_code +35 arch/x86/kernel/zhaoxin_kh40000.c 34 > 35 unsigned long zhaoxin_patch_code = ZHAOXIN_PATCH_CODE_DEFAULT; 36 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 31 May '24

31 May '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] drm/nouveau/debugfs: fix file release memory leak
by Zheng Zucheng 31 May '24

31 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.211 commit 1508b09945bde393326a9dab73b1fc35f672d771 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NL CVE: CVE-2021-47423 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ] When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked. Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Karol Herbst <kherbst(a)redhat.com> Signed-off-by: Karol Herbst <kherbst(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yang… Signed-off-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c index 9635704a1d86..41f9c53302ab 100644 --- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c +++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c @@ -182,6 +182,7 @@ static const struct file_operations nouveau_pstate_fops = { .open = nouveau_debugfs_pstate_open, .read = seq_read, .write = nouveau_debugfs_pstate_set, + .release = single_release, }; static struct drm_info_list nouveau_debugfs_list[] = { -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] Fix CVE-2023-52732
by Zizhi Wo 31 May '24

31 May '24

V3: Fix wrong adaptation in remove_session_caps_cb(). V2: Modify conflicting files in the commit message. V1: Fix main error. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/caps.c | 138 ++++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 142 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 10 files changed, 289 insertions(+), 129 deletions(-) -- 2.39.2

2 6

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 31 May '24

31 May '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v2 0/7] net: Backport hulk patches
by Dong Chenchen 31 May '24

31 May '24

Backport hulk patches Dong Chenchen (1): net: xfrm: skip policies marked as dead while reinserting policies Lu Wei (4): netfilter: make return-type and function-name in the same line bpf: fix magic numbers in bpf_get_sockops_uid_gid() bpf: socketmap: add Kconfig for customized socketmap tcp_comp: modify default value of TCP_COMP to n Ziyang Xuan (2): bpf: fix format type mismatch warning bpf: fix type incompatible warning arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/net/netfilter/nf_conntrack.h | 2 ++ include/net/sock.h | 6 +++++- net/Kconfig | 10 ++++++++++ net/core/filter.c | 11 ++++++++++- net/core/sock.c | 4 ++++ net/ipv4/Kconfig | 1 + net/netfilter/nf_conntrack_proto.c | 16 +++++++++++----- net/socket.c | 2 ++ net/xfrm/xfrm_policy.c | 13 +++++++++---- 11 files changed, 56 insertions(+), 11 deletions(-) -- 2.25.1

2 8

[PATCH OLK-5.10] dma-direct: Leak pages on dma_set_decrypted() failure
by Jinjiang Tu 31 May '24

31 May '24

From: Rick Edgecombe <rick.p.edgecombe(a)intel.com> mainline inclusion from mainline-v6.9-rc1 commit b9fa16949d18e06bdf728a560f5c8af56d2bdcaf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIS CVE: CVE-2024-35939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them. Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflicts: kernel/dma/direct.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- kernel/dma/direct.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c index f13493c54629..9f08d81ce1f8 100644 --- a/kernel/dma/direct.c +++ b/kernel/dma/direct.c @@ -243,7 +243,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, err = set_memory_decrypted((unsigned long)ret, PFN_UP(size)); if (err) - goto out_free_pages; + goto out_leak_pages; } memset(ret, 0, size); @@ -270,6 +270,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, out_free_pages: __dma_direct_free_pages(dev, page, size); return NULL; +out_leak_pages: + return NULL; } void dma_direct_free(struct device *dev, size_t size, @@ -333,7 +335,7 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, ret = page_address(page); if (force_dma_unencrypted(dev)) { if (set_memory_decrypted((unsigned long)ret, PFN_UP(size))) - goto out_free_pages; + goto out_leak_pages; } memset(ret, 0, size); *dma_handle = phys_to_dma_direct(dev, page_to_phys(page)); @@ -341,6 +343,8 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, out_free_pages: __dma_direct_free_pages(dev, page, size); return NULL; +out_leak_pages: + return NULL; } void dma_direct_free_pages(struct device *dev, size_t size, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-35808
by Li Nan 31 May '24

31 May '24

Li Nan (2): md/dm-raid: don't call md_reap_sync_thread() directly md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen drivers/md/md.h | 2 ++ drivers/md/dm-raid.c | 16 ++++++++-------- drivers/md/md.c | 6 ++++-- 3 files changed, 14 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] CVE-2024-35808
by Li Nan 31 May '24

31 May '24

Li Nan (2): md/dm-raid: don't call md_reap_sync_thread() directly md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen drivers/md/md.h | 2 ++ drivers/md/dm-raid.c | 16 ++++++++-------- drivers/md/md.c | 6 ++++-- 3 files changed, 14 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-6.6 9622/9794] arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static?
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 147f67b8431ec3c45060ee19e8458bec4354b6b8 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9622/9794] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-randconfig-123-20240531 (https://download.01.org/0day-ci/archive/20240531/202405311007.oNegiICq-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240531/202405311007.oNegiICq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405311007.oNegiICq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static? vim +/zhaoxin_patch_code +35 arch/x86/kernel/zhaoxin_kh40000.c 34 > 35 unsigned long zhaoxin_patch_code = ZHAOXIN_PATCH_CODE_DEFAULT; 36 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] locking/ww_mutex/test: Fix potential workqueue corruption
by Xie XiuQi 31 May '24

31 May '24

From: John Stultz <jstultz(a)google.com> stable inclusion from stable-v5.10.202 commit 9ed2d68b3925145f5f51c46559484881d6082f75 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFIG CVE: CVE-2023-52836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ] In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished. Often this would cause strange crashes as the mutexes would be freed while they were being used. Looking at the code, there is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that are passed to the workqueue threads. Then when the workqueue threads are finished, they free the stress struct that was passed to them. Unfortunately the workqueue work_struct node is in the stress struct. Which means the work_struct is freed before the work thread returns and while flush_workqueue is waiting. It seems like a better idea to have the controlling thread both allocate and free the stress structures, so that we can be sure we don't corrupt the workqueue by freeing the structure prematurely. So this patch reworks the test to do so, and with this change I no longer see the early flush_workqueue returns. Signed-off-by: John Stultz <jstultz(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- kernel/locking/test-ww_mutex.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c index 3e82f449b4ff..da36997d8742 100644 --- a/kernel/locking/test-ww_mutex.c +++ b/kernel/locking/test-ww_mutex.c @@ -426,7 +426,6 @@ static void stress_inorder_work(struct work_struct *work) } while (!time_after(jiffies, stress->timeout)); kfree(order); - kfree(stress); } struct reorder_lock { @@ -491,7 +490,6 @@ static void stress_reorder_work(struct work_struct *work) list_for_each_entry_safe(ll, ln, &locks, link) kfree(ll); kfree(order); - kfree(stress); } static void stress_one_work(struct work_struct *work) @@ -512,8 +510,6 @@ static void stress_one_work(struct work_struct *work) break; } } while (!time_after(jiffies, stress->timeout)); - - kfree(stress); } #define STRESS_INORDER BIT(0) @@ -524,15 +520,24 @@ static void stress_one_work(struct work_struct *work) static int stress(int nlocks, int nthreads, unsigned int flags) { struct ww_mutex *locks; - int n; + struct stress *stress_array; + int n, count; locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL); if (!locks) return -ENOMEM; + stress_array = kmalloc_array(nthreads, sizeof(*stress_array), + GFP_KERNEL); + if (!stress_array) { + kfree(locks); + return -ENOMEM; + } + for (n = 0; n < nlocks; n++) ww_mutex_init(&locks[n], &ww_class); + count = 0; for (n = 0; nthreads; n++) { struct stress *stress; void (*fn)(struct work_struct *work); @@ -556,9 +561,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags) if (!fn) continue; - stress = kmalloc(sizeof(*stress), GFP_KERNEL); - if (!stress) - break; + stress = &stress_array[count++]; INIT_WORK(&stress->work, fn); stress->locks = locks; @@ -573,6 +576,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags) for (n = 0; n < nlocks; n++) ww_mutex_destroy(&locks[n]); + kfree(stress_array); kfree(locks); return 0; -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] efi/capsule-loader: fix incorrect allocation size
by Kaixiong Yu 31 May '24

31 May '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.212 commit 537e3f49dbe88881a6f0752beaa596942d9efd64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LN CVE: CVE-2024-27413 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fccfa646ef3628097d59f7d9c1a3e84d4b6bb45e ] gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here. Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/firmware/efi/capsule-loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c index 3e8d4b51a814..97bafb5f7038 100644 --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -292,7 +292,7 @@ static int efi_capsule_open(struct inode *inode, struct file *file) return -ENOMEM; } - cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); + cap_info->phys = kzalloc(sizeof(phys_addr_t), GFP_KERNEL); if (!cap_info->phys) { kfree(cap_info->pages); kfree(cap_info); -- 2.25.1

2 1

[PATCH OLK-5.10] efi/capsule-loader: fix incorrect allocation size
by Kaixiong Yu 31 May '24

31 May '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.212 commit 537e3f49dbe88881a6f0752beaa596942d9efd64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LN CVE: CVE-2024-27413 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fccfa646ef3628097d59f7d9c1a3e84d4b6bb45e ] gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here. Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/firmware/efi/capsule-loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c index 3e8d4b51a814..97bafb5f7038 100644 --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -292,7 +292,7 @@ static int efi_capsule_open(struct inode *inode, struct file *file) return -ENOMEM; } - cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); + cap_info->phys = kzalloc(sizeof(phys_addr_t), GFP_KERNEL); if (!cap_info->phys) { kfree(cap_info->pages); kfree(cap_info); -- 2.25.1

2 1

[PATCH OLK-5.10] cvm: clean code for cvm init
by Ju Fu 31 May '24

31 May '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9TM0T -------------------------------- clean code for cvm init Signed-off-by: Ju Fu <fuju1(a)huawei.com> --- arch/arm64/include/asm/kvm_pgtable.h | 3 -- arch/arm64/include/asm/kvm_tmi.h | 5 +++ arch/arm64/kvm/arm.c | 35 -------------------- arch/arm64/kvm/cvm.c | 49 +++++++++++++++++++++++++--- arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 ----------- 5 files changed, 49 insertions(+), 62 deletions(-) diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h index 2068ec591..f5dff6d40 100644 --- a/arch/arm64/include/asm/kvm_pgtable.h +++ b/arch/arm64/include/asm/kvm_pgtable.h @@ -53,9 +53,6 @@ enum kvm_pgtable_prot { KVM_PGTABLE_PROT_PBHA3 = BIT(62), }; -#define TMI_NO_MEASURE_CONTENT U(0) -#define TMI_MEASURE_CONTENT U(1) - #define PAGE_HYP (KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_W) #define PAGE_HYP_EXEC (KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_X) #define PAGE_HYP_RO (KVM_PGTABLE_PROT_R) diff --git a/arch/arm64/include/asm/kvm_tmi.h b/arch/arm64/include/asm/kvm_tmi.h index 68a2da685..536594017 100644 --- a/arch/arm64/include/asm/kvm_tmi.h +++ b/arch/arm64/include/asm/kvm_tmi.h @@ -211,6 +211,9 @@ struct tmi_tec_run { #define U(_x) (_x##U) +#define TMI_NO_MEASURE_CONTENT U(0) +#define TMI_MEASURE_CONTENT U(1) + /* * SMC_TMM_INIT_COMPLETE is the only function in the TMI that originates from * the CVM world and is handled by the SPMD. The remaining functions are @@ -384,6 +387,8 @@ unsigned long cvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu, unsigned long target_affinity, unsigned long lowest_affinity_level); int kvm_cvm_vcpu_set_events(struct kvm_vcpu *vcpu, bool serror_pending, bool ext_dabt_pending); +int kvm_create_cvm_vm(struct kvm *kvm); +int kvm_init_cvm_vm(struct kvm *kvm); #endif #endif diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 16cff3900..363f62073 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -145,41 +145,6 @@ static void set_default_csv2(struct kvm *kvm) kvm->arch.pfr0_csv2 = 1; } -static int kvm_create_cvm_vm(struct kvm *kvm) -{ - struct cvm *cvm; - - if (!static_key_enabled(&kvm_cvm_is_available)) - return -EFAULT; - - if (kvm->arch.cvm) { - kvm_info("cvm already create.\n"); - return 0; - } - - kvm->arch.cvm = kzalloc(sizeof(struct cvm), GFP_KERNEL_ACCOUNT); - if (!kvm->arch.cvm) - return -ENOMEM; - - cvm = (struct cvm *)kvm->arch.cvm; - cvm->is_cvm = true; - return 0; -} - -static int kvm_init_cvm_vm(struct kvm *kvm) -{ - struct tmi_cvm_params *params; - struct cvm *cvm = (struct cvm *)kvm->arch.cvm; - - params = kzalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT); - if (!params) - return -ENOMEM; - - cvm->params = params; - - return 0; -} - /** * kvm_arch_init_vm - initializes a VM data structure * @kvm: pointer to the KVM struct diff --git a/arch/arm64/kvm/cvm.c b/arch/arm64/kvm/cvm.c index 7f4de2522..70521fec8 100644 --- a/arch/arm64/kvm/cvm.c +++ b/arch/arm64/kvm/cvm.c @@ -158,8 +158,10 @@ int kvm_arm_create_cvm(struct kvm *kvm) if (!kvm_is_cvm(kvm) || kvm_cvm_state(kvm) != CVM_STATE_NONE) return 0; - if (!cvm->params) - return -EFAULT; + if (!cvm->params) { + ret = -EFAULT; + goto out; + } ret = cvm_vmid_reserve(); if (ret < 0) @@ -184,12 +186,14 @@ int kvm_arm_create_cvm(struct kvm *kvm) } WRITE_ONCE(cvm->state, CVM_STATE_NEW); - kfree(cvm->params); - cvm->params = NULL; - return ret; + ret = 0; out: kfree(cvm->params); cvm->params = NULL; + if (ret < 0) { + kfree(cvm); + kvm->arch.cvm = NULL; + } return ret; } @@ -835,3 +839,38 @@ int kvm_cvm_vcpu_set_events(struct kvm_vcpu *vcpu, } return 0; } + +int kvm_create_cvm_vm(struct kvm *kvm) +{ + struct cvm *cvm; + + if (!static_key_enabled(&kvm_cvm_is_available)) + return -EFAULT; + + if (kvm->arch.cvm) { + kvm_info("cvm already create.\n"); + return 0; + } + + kvm->arch.cvm = kzalloc(sizeof(struct cvm), GFP_KERNEL_ACCOUNT); + if (!kvm->arch.cvm) + return -ENOMEM; + + cvm = (struct cvm *)kvm->arch.cvm; + cvm->is_cvm = true; + return 0; +} + +int kvm_init_cvm_vm(struct kvm *kvm) +{ + struct tmi_cvm_params *params; + struct cvm *cvm = (struct cvm *)kvm->arch.cvm; + + params = kzalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT); + if (!params) + return -ENOMEM; + + cvm->params = params; + + return 0; +} diff --git a/arch/arm64/kvm/hyp/vgic-v3-sr.c b/arch/arm64/kvm/hyp/vgic-v3-sr.c index a45e68ef2..452f4cacd 100644 --- a/arch/arm64/kvm/hyp/vgic-v3-sr.c +++ b/arch/arm64/kvm/hyp/vgic-v3-sr.c @@ -229,25 +229,6 @@ void __vgic_v3_save_state(struct vgic_v3_cpu_if *cpu_if) } } -#ifdef CONFIG_CVM_HOST -void __vgic_v3_restore_tec_state(struct vgic_v3_cpu_if *cpu_if, - u64 *entry_hcr, - u64 *entry_lrs) -{ - u64 used_lrs = cpu_if->used_lrs; - int i; - - *entry_hcr = cpu_if->vgic_hcr; - for (i = 0; i < kvm_vgic_global_state.nr_lr; ++i) { - if (i < used_lrs) { - entry_lrs[i] = cpu_if->vgic_lr[i]; - } else { - entry_lrs[i] = 0; - } - } -} -#endif - void __vgic_v3_restore_state(struct vgic_v3_cpu_if *cpu_if) { u64 used_lrs = cpu_if->used_lrs; -- 2.25.1.windows.1

2 1

[PATCH openEuler-1.0-LTS] net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
by Pu Lehui 31 May '24

31 May '24

From: Zhou Qingyang <zhou1615(a)umn.edu> stable inclusion from stable-v4.19.220 commit 676dc7d9b15bf8733233a2db1ec3f9091ab34275 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S1ZN CVE: CVE-2021-47541 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit addad7643142f500080417dd7272f49b7a185570 upstream. In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq will be freed on the error path of mlx4_en_copy_priv(). After that mlx4_en_alloc_resources() is called and there is a dereference of &tmp->tx_cq[t][i] in mlx4_en_alloc_resources(), which could lead to a use after free problem on failure of mlx4_en_copy_priv(). Fix this bug by adding a check of mlx4_en_copy_priv() This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_MLX4_EN=m show no new warnings, and our static analyzer no longer warns about this code. Fixes: ec25bc04ed8e ("net/mlx4_en: Add resilience in low memory systems") Signed-off-by: Zhou Qingyang <zhou1615(a)umn.edu> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Link: https://lore.kernel.org/r/20211130164438.190591-1-zhou1615@umn.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c index 47eee3e083ec..e60ca4c86482 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c @@ -2279,9 +2279,14 @@ int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv, bool carry_xdp_prog) { struct bpf_prog *xdp_prog; - int i, t; + int i, t, ret; - mlx4_en_copy_priv(tmp, priv, prof); + ret = mlx4_en_copy_priv(tmp, priv, prof); + if (ret) { + en_warn(priv, "%s: mlx4_en_copy_priv() failed, return\n", + __func__); + return ret; + } if (mlx4_en_alloc_resources(tmp)) { en_warn(priv, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] efi/capsule-loader: fix incorrect allocation size
by Kaixiong Yu 31 May '24

31 May '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.212 commit 537e3f49dbe88881a6f0752beaa596942d9efd64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LN CVE: CVE-2024-27413 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fccfa646ef3628097d59f7d9c1a3e84d4b6bb45e ] gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here. Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/firmware/efi/capsule-loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c index 94aae1e67c99..43fefab75524 100644 --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -293,7 +293,7 @@ static int efi_capsule_open(struct inode *inode, struct file *file) return -ENOMEM; } - cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); + cap_info->phys = kzalloc(sizeof(phys_addr_t), GFP_KERNEL); if (!cap_info->phys) { kfree(cap_info->pages); kfree(cap_info); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] perf: hisi: Fix use-after-free when register pmu fails
by Luo Gengkun 31 May '24

31 May '24

From: Junhao He <hejunhao3(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit b805cafc604bfdb671fae7347a57f51154afa735 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RKWV CVE: CVE-2023-52859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we fail to register the uncore pmu, the pmu context may not been allocated. The error handing will call cpuhp_state_remove_instance() to call uncore pmu offline callback, which migrate the pmu context. Since that's liable to lead to some kind of use-after-free. Use cpuhp_state_remove_instance_nocalls() instead of cpuhp_state_remove_instance() so that the notifiers don't execute after the PMU device has been failed to register. Fixes: a0ab25cd82ee ("drivers/perf: hisi: Add support for HiSilicon PA PMU driver") FIxes: 3bf30882c3c7 ("drivers/perf: hisi: Add support for HiSilicon SLLC PMU driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Link: https://lore.kernel.org/r/20231024113630.13472-1-hejunhao3@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 4 ++-- drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c b/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c index f1e6b5cee075..65ed4aa19266 100644 --- a/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_pa_pmu.c @@ -430,8 +430,8 @@ static int hisi_pa_pmu_probe(struct platform_device *pdev) ret = perf_pmu_register(&pa_pmu->pmu, name, -1); if (ret) { dev_err(pa_pmu->dev, "PMU register failed, ret = %d\n", ret); - cpuhp_state_remove_instance(CPUHP_AP_PERF_ARM_HISI_PA_ONLINE, - &pa_pmu->node); + cpuhp_state_remove_instance_nocalls(CPUHP_AP_PERF_ARM_HISI_PA_ONLINE, + &pa_pmu->node); return ret; } diff --git a/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c index 835ec3e2178f..1a3d58ca854c 100644 --- a/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c @@ -463,8 +463,8 @@ static int hisi_sllc_pmu_probe(struct platform_device *pdev) ret = perf_pmu_register(&sllc_pmu->pmu, name, -1); if (ret) { dev_err(sllc_pmu->dev, "PMU register failed, ret = %d\n", ret); - cpuhp_state_remove_instance(CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE, - &sllc_pmu->node); + cpuhp_state_remove_instance_nocalls(CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE, + &sllc_pmu->node); return ret; } -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 3b9084bc58cd998558c3ea0c650ff6598c2d7a64
by kernel test robot 31 May '24

31 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 3b9084bc58cd998558c3ea0c650ff6598c2d7a64 !8195 CVE-2024-35956 Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 736m configs tested: 35 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240531 clang arm64 randconfig-002-20240531 clang arm64 randconfig-003-20240531 gcc arm64 randconfig-004-20240531 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240531 clang x86_64 buildonly-randconfig-002-20240531 gcc x86_64 buildonly-randconfig-003-20240531 clang x86_64 buildonly-randconfig-004-20240531 clang x86_64 buildonly-randconfig-005-20240531 gcc x86_64 buildonly-randconfig-006-20240531 clang x86_64 defconfig gcc x86_64 randconfig-001-20240531 gcc x86_64 randconfig-002-20240531 clang x86_64 randconfig-003-20240531 gcc x86_64 randconfig-004-20240531 gcc x86_64 randconfig-005-20240531 gcc x86_64 randconfig-006-20240531 gcc x86_64 randconfig-011-20240531 clang x86_64 randconfig-012-20240531 gcc x86_64 randconfig-013-20240531 gcc x86_64 randconfig-014-20240531 clang x86_64 randconfig-015-20240531 gcc x86_64 randconfig-016-20240531 gcc x86_64 randconfig-071-20240531 clang x86_64 randconfig-072-20240531 gcc x86_64 randconfig-073-20240531 gcc x86_64 randconfig-074-20240531 gcc x86_64 randconfig-075-20240531 clang x86_64 randconfig-076-20240531 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 03933bd11a64b94203f2cbe30ae71061807872fb
by kernel test robot 31 May '24

31 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 03933bd11a64b94203f2cbe30ae71061807872fb !8181 v3 cpu/hotplug: Don't offline the last non-isolated CPU Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405310225.ixqT7RKx-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405310530.QbRwB9XW-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) include/linux/uaccess.h:112:17: warning: 'pid' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'pmas' may be used uninitialized [-Wmaybe-uninitialized] kernel/sched/fair.c:6701:33: error: invalid use of undefined type 'struct task_group' Unverified Error/Warning (likely false positive, please contact us if interested): net/tipc/udp_media.c:775 cleanup_bearer() warn: variable dereferenced before check 'ub->ubsock' (see line 774) net/tipc/udp_media.c:796 tipc_udp_disable() error: we previously assumed 'ub->ubsock' could be null (see line 791) Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-001-20240531 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code | `-- kernel-sched-fair.c:error:invalid-use-of-undefined-type-struct-task_group |-- arm64-randconfig-002-20240531 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code | |-- include-linux-uaccess.h:warning:pid-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:pmas-may-be-used-uninitialized |-- arm64-randconfig-003-20240531 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-004-20240531 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-005-20240531 | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-netfilter-xt_TEE.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-randconfig-004-20240531 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-randconfig-161-20240531 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20240531 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20240531 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-071-20240531 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-randconfig-161-20240530 |-- net-tipc-udp_media.c-cleanup_bearer()-warn:variable-dereferenced-before-check-ub-ubsock-(see-line-) `-- net-tipc-udp_media.c-tipc_udp_disable()-error:we-previously-assumed-ub-ubsock-could-be-null-(see-line-) elapsed time: 733m configs tested: 35 configs skipped: 146 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240531 gcc arm64 randconfig-002-20240531 gcc arm64 randconfig-003-20240531 gcc arm64 randconfig-004-20240531 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240531 clang x86_64 buildonly-randconfig-002-20240531 gcc x86_64 buildonly-randconfig-003-20240531 clang x86_64 buildonly-randconfig-004-20240531 clang x86_64 buildonly-randconfig-005-20240531 gcc x86_64 buildonly-randconfig-006-20240531 clang x86_64 defconfig gcc x86_64 randconfig-001-20240531 gcc x86_64 randconfig-002-20240531 clang x86_64 randconfig-003-20240531 gcc x86_64 randconfig-004-20240531 gcc x86_64 randconfig-005-20240531 gcc x86_64 randconfig-006-20240531 gcc x86_64 randconfig-011-20240531 clang x86_64 randconfig-012-20240531 gcc x86_64 randconfig-013-20240531 gcc x86_64 randconfig-014-20240531 clang x86_64 randconfig-015-20240531 gcc x86_64 randconfig-016-20240531 gcc x86_64 randconfig-071-20240531 clang x86_64 randconfig-072-20240531 gcc x86_64 randconfig-073-20240531 gcc x86_64 randconfig-074-20240531 gcc x86_64 randconfig-075-20240531 clang x86_64 randconfig-076-20240531 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0